This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 9989a953fe78a6c05de314bcac603e653cb8ef0a Author: iSold Leo <[email protected]> AuthorDate: Tue Aug 4 19:50:11 2026 +0800 Commit: Michael Niedermayer <[email protected]> CommitDate: Wed Aug 12 04:51:58 2026 +0200 avfilter/af_pan: check the id of named input channels before use parse_channel_name() only rejects negative values on the named channel path, while the numbered "c%d" path also checks against MAX_CHANNELS. av_channel_from_string() accepts UNSD (512), UNK (768) and AMBI (1024), and the id was then used directly to index used_in_ch[MAX_CHANNELS] on the stack and pan->gain[out_ch_id][in_ch_id]. Before this change: ffmpeg -f lavfi -i "anullsrc=cl=stereo" -af "pan=stereo|FL=AMBI" -f null - af_pan.c:214:17: runtime error: index 1024 out of bounds for type 'int[64]' The first out of bounds access is the read at the "reference twice" check, so the symptom depends on what happens to be on the stack: FL=UNK is silently accepted and produces silence, FL=UNSD reports "Can not reference in channel 512 twice", and FL=AMBI aborts. The check has to be at the caller and not in parse_channel_name(), which is shared with the out channel path: there the named id is converted by av_channel_layout_index_from_channel() into a layout index, so high ids are legitimately supported and "pan=AMBI|AMBI=FL" works. AVERROR_PATCHWELCOME is used because these are valid AVChannel values that af_pan cannot represent: for named input channels the gain matrix is indexed by the raw id, and the renumbering loop in config_props() is bounded by MAX_CHANNELS as well, so such a mapping never worked. The in_ch_id < 0 half is currently unreachable and only kept for symmetry with the out channel check above. Regression since 1f96db959c1235bb7079d354e09914a0a2608f62, which dropped the "channel_id >= MAX_CHANNELS" part of the check when converting to the new channel layout API. Reported-by: karnakarreddi Fixes: #22963 Signed-off-by: iSold Leo <[email protected]> (cherry picked from commit f02c4372ed28b40502a5d377a8a8d3492cafce58) Signed-off-by: Michael Niedermayer <[email protected]> --- libavfilter/af_pan.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavfilter/af_pan.c b/libavfilter/af_pan.c index 32bd28fe0a..abb0e5804d 100644 --- a/libavfilter/af_pan.c +++ b/libavfilter/af_pan.c @@ -211,6 +211,12 @@ static av_cold int init(AVFilterContext *ctx) ret = AVERROR(EINVAL); goto fail; } + if (in_ch_id < 0 || in_ch_id >= MAX_CHANNELS) { + av_log(ctx, AV_LOG_ERROR, + "Input channel id %d is not supported\n", in_ch_id); + ret = AVERROR_PATCHWELCOME; + goto fail; + } if (used_in_ch[in_ch_id]) { av_log(ctx, AV_LOG_ERROR, "Can not reference in channel %d twice\n", in_ch_id); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
