PR #24923 opened by Forgejo_Fairy URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24923 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24923.patch
Fixes #24344. `config_input()` doubled a potentially negative `nsamples_max` as `int`. For a large accepted delay, that multiplication overflows and can select an RDFT buffer too small for `generate_kernel()`. Perform the comparison in `int64_t` so the filter rejects delays that exceed its RDFT limit. Add a FATE test using the reported 48 kHz, 12,500-second delay. It checks that configuration fails with the existing “too large delay” error. Verified with an AddressSanitizer build: the reported command produces a heap-buffer-overflow before this change and fails cleanly afterward. `make fate-filter-firequalizer-large-delay SAMPLES=/opt/fate-suite` passes. At 48 kHz, delays of `0.01` and `0.45` seconds still succeed, while `0.46` seconds is rejected. From 74bc9dcff02bc32036d8cbf6ef901bb39ef79271 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 7 Oct 2026 16:01:50 +0000 Subject: [PATCH] avfilter/firequalizer: avoid overflow selecting RDFT length The nsamples_max doubling can overflow int for an accepted delay, causing an undersized RDFT and an out-of-bounds write during kernel generation. Compare in int64_t so excessive delays take the existing error path. Add a FATE check for the reported delay. Assisted-by: Fairy --- libavfilter/af_firequalizer.c | 2 +- tests/fate/filter-audio.mak | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/libavfilter/af_firequalizer.c b/libavfilter/af_firequalizer.c index 63ac308365..809741218d 100644 --- a/libavfilter/af_firequalizer.c +++ b/libavfilter/af_firequalizer.c @@ -747,7 +747,7 @@ static int config_input(AVFilterLink *inlink) for (rdft_bits = RDFT_BITS_MIN; rdft_bits <= RDFT_BITS_MAX; rdft_bits++) { s->rdft_len = 1 << rdft_bits; s->nsamples_max = s->rdft_len - s->fir_len + 1; - if (s->nsamples_max * 2 >= s->fir_len) + if ((int64_t)s->nsamples_max * 2 >= s->fir_len) break; } diff --git a/tests/fate/filter-audio.mak b/tests/fate/filter-audio.mak index b5c27daf1c..4d8d52ca91 100644 --- a/tests/fate/filter-audio.mak +++ b/tests/fate/filter-audio.mak @@ -147,6 +147,12 @@ fate-filter-firequalizer: CMP = oneoff fate-filter-firequalizer: CMP_UNIT = s16 fate-filter-firequalizer: SIZE_TOLERANCE = 1058400 - 1097208 +# The FIR length fits in int, but no supported RDFT length can contain it. +FATE_AFILTER-$(call ALLYES, LAVFI_INDEV SINE_FILTER FIREQUALIZER_FILTER PCM_S16LE_DECODER PCM_S16LE_ENCODER NULL_MUXER) += fate-filter-firequalizer-large-delay +fate-filter-firequalizer-large-delay: CMD = ! run $(FFMPEG) -nostdin -hide_banner -f lavfi -i "sine=sample_rate=48000" -af "firequalizer=delay=12500" -t 0.1 -f null - +fate-filter-firequalizer-large-delay: CMP = grep +fate-filter-firequalizer-large-delay: REF = too large delay, please decrease it. + FATE_AFILTER-$(call FILTERDEMDECENCMUX, PAN, WAV, PCM_S16LE, PCM_S16LE, WAV) += fate-filter-pan-mono1 fate-filter-pan-mono1: tests/data/asynth-44100-2.wav fate-filter-pan-mono1: SRC = $(TARGET_PATH)/tests/data/asynth-44100-2.wav -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
