PR #25575 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25575 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25575.patch
Fixes: signed integer overflow Fixes: out of array write Fixes: 4T4QtWPFfCiD Fixes: Depthfirst issue 019f3b84-908c-7752-be91-62fb35f8911e Out of array write Replicated through UnModified FFmpeg with ASAN and UBSAN The out of array write is a regression since 4e0a8b745a, the overflow of the sum is older. Found-by: Michael Niedermayer <[email protected]> using Depthfirst Signed-off-by: Michael Niedermayer <[email protected]> # Summary of changes Briefly describe what this PR does and why. <!-- If this PR requires new FATE test samples, attach them to the PR and list their target paths below (relative to the fate-suite root). Attached filenames must match the sample's filename: ```fate-samples # e.g. vorbis/new-sample.ogg ``` --> >From 17a634c3fbd9f0e242c2022685cb7b7c487eca30 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 27 Oct 2026 13:09:30 +0100 Subject: [PATCH] avfilter/af_amerge: check the channel count of each input before summing Fixes: signed integer overflow Fixes: out of array write Fixes: 4T4QtWPFfCiD Fixes: Depthfirst issue 019f3b84-908c-7752-be91-62fb35f8911e Out of array write Replicated through UnModified FFmpeg with ASAN and UBSAN The out of array write is a regression since 4e0a8b745a, the overflow of the sum is older. Found-by: Michael Niedermayer <[email protected]> using Depthfirst Signed-off-by: Michael Niedermayer <[email protected]> --- libavfilter/af_amerge.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavfilter/af_amerge.c b/libavfilter/af_amerge.c index 8c574f7bda2..07dc8042014 100644 --- a/libavfilter/af_amerge.c +++ b/libavfilter/af_amerge.c @@ -109,12 +109,12 @@ static int query_formats(AVFilterContext *ctx) av_log(ctx, AV_LOG_INFO, "Using \"%s\" for input %d\n", buf, i + 1); } s->in[i].nb_ch = INLAYOUT(ctx, i)->nb_channels; + if (s->in[i].nb_ch > SWR_CH_MAX - nb_ch) { + av_log(ctx, AV_LOG_ERROR, "Too many channels (max %d)\n", SWR_CH_MAX); + return AVERROR(EINVAL); + } nb_ch += s->in[i].nb_ch; } - if (nb_ch > SWR_CH_MAX) { - av_log(ctx, AV_LOG_ERROR, "Too many channels (max %d)\n", SWR_CH_MAX); - return AVERROR(EINVAL); - } ret = av_channel_layout_custom_init(&outlayout, nb_ch); if (ret < 0) return ret; -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
