This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit e70b1eddba1028e84dff6acbf7ce80336a2ccbe4 Author: James Almer <[email protected]> AuthorDate: Wed Sep 23 20:53:48 2026 +0200 Commit: michaelni <[email protected]> CommitDate: Sat Oct 10 21:27:56 2026 +0000 avutil/opt: do not free a custom channel map the source still points to av_opt_copy() documents that after it returns, allocated options in src and dst no longer alias each other, even when dst was memdup'ed from src. For AV_OPT_TYPE_CHLAYOUT it passed such aliased layouts straight to av_channel_layout_copy(), which frees the custom map in dst and then copies from the now freed map in src. Handle this in opt_copy_elem(), like the AV_OPT_TYPE_DICT case, by forgetting the aliased map in dst before the copy. Fixes: heap-use-after-free Fixes: BTOI3sLHWE0g Found-by: Joshua Rogers <[email protected]> --- libavutil/opt.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/libavutil/opt.c b/libavutil/opt.c index b02efb9ff9..03fca6ad15 100644 --- a/libavutil/opt.c +++ b/libavutil/opt.c @@ -2169,8 +2169,15 @@ static int opt_copy_elem(void *logctx, enum AVOptionType type, *ddictp = NULL; return av_dict_copy(ddictp, sdict, 0); } else if (type == AV_OPT_TYPE_CHLAYOUT) { - if (dst != src) + const AVChannelLayout *slayout = (const AVChannelLayout *)src; + AVChannelLayout *dlayout = (AVChannelLayout *)dst; + if (dlayout != slayout) { + if (dlayout->order == AV_CHANNEL_ORDER_CUSTOM && + slayout->order == AV_CHANNEL_ORDER_CUSTOM && + dlayout->u.map == slayout->u.map) + dlayout->u.map = NULL; return av_channel_layout_copy(dst, src); + } } else if (opt_is_pod(type)) { size_t size = opt_type_desc[type].size; memcpy(dst, src, size); -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
