PR #25191 opened by Marti2203
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25191
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25191.patch
The documented `next` command of the concat filter ("Close the current segment
and step to the next one") calls `flush_segment()` without checking that there
is a next segment. Sent during the last segment, it moves `cur_idx` past the
last input while the outputs still want frames, so `activate()` indexes
`cat->in[]` and `ctx->inputs[]` out of bounds and crashes:
```
ffmpeg -f lavfi -i
"testsrc2=s=64x48:r=10:d=0.2[a];testsrc2=s=64x48:r=10:d=1[b];[a][b]concat=n=2:v=1:a=0,sendcmd=c='0.3
concat next'" -f null -
```
Valgrind reports invalid reads and an invalid write in
`ff_inlink_request_frame()` called from `activate()` (avf_concat.c:432),
followed by a segfault.
With the patch the command fails with "There is no next segment" on the last
segment and the filter continues normally; `next` during an earlier segment
behaves as before (same output frames), and `fate-filter-concat`,
`fate-filter-concat-vfr` and `fate-filter-photosensitivity-blend` pass. Ending
the output on `next` in the last segment would be an alternative; I went for
the minimal change.
This issue was found by an LLM-Enhanced Static Analysis Engine and verified
manually.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
From 28981cfdd968c64f7399257d7527fd3170a4ea8b Mon Sep 17 00:00:00 2001
From: Martin Mirchev <[email protected]>
Date: Sun, 18 Oct 2026 22:09:04 +0800
Subject: [PATCH] avfilter/avf_concat: reject the next command on the last
segment
process_command() called flush_segment() without checking that there is a
next segment. On the last segment this moved cur_idx past the inputs while
the outputs still wanted frames, so activate() accessed cat->in[] and
ctx->inputs[] out of bounds and crashed, e.g.
ffmpeg -f lavfi -i
"testsrc2=d=0.2[a];testsrc2=d=1[b];[a][b]concat=n=2,sendcmd=c='0.3 concat
next'" -f null -
Fail the command instead.
Signed-off-by: Martin Mirchev <[email protected]>
---
libavfilter/avf_concat.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libavfilter/avf_concat.c b/libavfilter/avf_concat.c
index 531aa071a0..f6a1f758f5 100644
--- a/libavfilter/avf_concat.c
+++ b/libavfilter/avf_concat.c
@@ -444,7 +444,13 @@ static int process_command(AVFilterContext *ctx, const
char *cmd, const char *ar
int ret = AVERROR(ENOSYS);
if (!strcmp(cmd, "next")) {
+ ConcatContext *cat = ctx->priv;
+
av_log(ctx, AV_LOG_VERBOSE, "Command received: next\n");
+ if (cat->cur_idx + ctx->nb_outputs >= ctx->nb_inputs) {
+ av_log(ctx, AV_LOG_WARNING, "There is no next segment\n");
+ return AVERROR(EINVAL);
+ }
return flush_segment(ctx);
}
--
2.54.0
_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
