PR #25214 opened by Forgejo_Fairy URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25214 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25214.patch
When flushing an input with no decoded audio frames, afwtdn can emit a frame with negative nb_samples. An automatically inserted aresample filter then reaches av_samples_set_silence() with an invalid count, producing AddressSanitizer's negative-size-param failure with size=-26572. Cherry-pick b1942734c7cbcdc9034034373abcc9ecb9644c47 onto release/5.0, preserving Paul B Mahol's authorship. The change clamps the output sample count and drains EOF padding across successive activations. Its code changes match [LiZhixuan's submitted backport](https://patchwork.ffmpeg.org/project/ffmpeg/patch/[email protected]/). Fixes #22775. Validation with Clang 18.1.3 and AddressSanitizer on AArch64: - The attached PoC and a valid 44-byte empty WAV both reproduce size=-26572 on unpatched release/5.0. - With this backport, the empty WAV exits successfully. The PoC retains its decoding errors and exits with code 69, without a sanitizer report. - Six nonempty tone inputs containing 1, 1024, 8192, 8193, 20000 and 48000 samples produce identical framemd5 output before and after the backport. - The upstream fix was independently verified against its parent with both reproducing inputs. - git diff --check passes. >From 993b46336229471b24a51b484f889859ff85ce55 Mon Sep 17 00:00:00 2001 From: Paul B Mahol <[email protected]> Date: Mon, 27 Nov 2023 11:45:34 +0100 Subject: [PATCH] avfilter/af_afwtdn: fix crash with EOF handling Fixes #22775. The backport has the same code changes as the patch submitted by LiZhixuan on 2026-04-10. (cherry picked from commit b1942734c7cbcdc9034034373abcc9ecb9644c47) Assisted-by: Fairy --- libavfilter/af_afwtdn.c | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/libavfilter/af_afwtdn.c b/libavfilter/af_afwtdn.c index 09b504d634..1839190736 100644 --- a/libavfilter/af_afwtdn.c +++ b/libavfilter/af_afwtdn.c @@ -410,6 +410,7 @@ typedef struct AudioFWTDNContext { uint64_t sn; int64_t eof_pts; + int eof; int wavelet_type; int channels; @@ -1071,7 +1072,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in) s->drop_samples = 0; } else { if (s->padd_samples < 0 && eof) { - out->nb_samples += s->padd_samples; + out->nb_samples = FFMAX(0, out->nb_samples + s->padd_samples); s->padd_samples = 0; } if (!eof) @@ -1210,23 +1211,26 @@ static int activate(AVFilterContext *ctx) FF_FILTER_FORWARD_STATUS_BACK(outlink, inlink); - ret = ff_inlink_consume_samples(inlink, s->nb_samples, s->nb_samples, &in); - if (ret < 0) - return ret; - if (ret > 0) - return filter_frame(inlink, in); + if (!s->eof) { + ret = ff_inlink_consume_samples(inlink, s->nb_samples, s->nb_samples, &in); + if (ret < 0) + return ret; + if (ret > 0) + return filter_frame(inlink, in); + } if (ff_inlink_acknowledge_status(inlink, &status, &pts)) { - if (status == AVERROR_EOF) { - while (s->padd_samples != 0) { - ret = filter_frame(inlink, NULL); - if (ret < 0) - return ret; - } - ff_outlink_set_status(outlink, status, pts); - return ret; - } + if (status == AVERROR_EOF) + s->eof = 1; } + + if (s->eof && s->padd_samples != 0) { + return filter_frame(inlink, NULL); + } else if (s->eof) { + ff_outlink_set_status(outlink, AVERROR_EOF, s->eof_pts); + return 0; + } + FF_FILTER_FORWARD_WANTED(outlink, inlink); return FFERROR_NOT_READY; -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
