PR #25224 opened by Forgejo_Fairy URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25224 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25224.patch
Backport 50f0f8c53c8 to release/5.0 to reject a zero-length delay buffer before allocation. This addresses #22778 and matches the change in the reporter's [mailing-list patch](https://patchwork.ffmpeg.org/project/ffmpeg/patch/[email protected]/). The attached PoC triggers an AddressSanitizer heap buffer overflow on the unpatched release/5.0 branch. With this change, filter configuration returns `Invalid argument` without a sanitizer error. A 48 kHz stereo input continues to process successfully. Tested on ARM64 with Clang AddressSanitizer and `--disable-asm`. >From 4034f2b1ea565f384fcf53b61b09051a755c379b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 23 Dec 2023 04:03:01 +0100 Subject: [PATCH] avfilter/af_stereowiden: Check length Fixes: out of array access Fixes: tickets/10746/poc13ffmpeg Found-by: Zeng Yunxiang Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 50f0f8c53c818f73fe2d752708e2fa9d2a2d8a07) Assisted-by: Fairy --- libavfilter/af_stereowiden.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavfilter/af_stereowiden.c b/libavfilter/af_stereowiden.c index 7cce1a8f28c..f1a5b108aac 100644 --- a/libavfilter/af_stereowiden.c +++ b/libavfilter/af_stereowiden.c @@ -74,6 +74,8 @@ static int config_input(AVFilterLink *inlink) s->length = s->delay * inlink->sample_rate / 1000; s->length *= 2; + if (s->length == 0) + return AVERROR(EINVAL); s->buffer = av_calloc(s->length, sizeof(*s->buffer)); if (!s->buffer) return AVERROR(ENOMEM); -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
