PR #25649 opened by Marti2203
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25649
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25649.patch
Follow-up to #25503, from a pre-existing issue noted in the Forgejo_Fairy
review there.
With `split_channels`, each channel gets `outlink->h / nb_channels` rows. When
the height is smaller than the number of channels, that is 0, and `mode=line`
starts its drawing loop at row -1, writing before the frame:
ffmpeg -f lavfi -i
'aevalsrc=0.5|-0.5:s=48000:d=0.05,showwaves=s=8x1:mode=line:n=1:split_channels=1'
-frames:v 1 -f null -
ASan reports a heap-buffer-overflow on master. The other modes and
`showwavespic` did not trip ASan here, but a 0-row channel draws nothing in any
of them, so the patch rejects the configuration in `config_output()`, which
both filters share. With the patch all four modes and `showwavespic` return
`EINVAL` for this input, and `s=8x2` with two channels still works under ASan.
This issue was found during an LLM review (Forgejo_Fairy, #25503); the fix was
verified manually.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
From 29bc2331421b7f64c01d70b890c7c823d4658f69 Mon Sep 17 00:00:00 2001
From: Martin Mirchev <[email protected]>
Date: Sun, 1 Nov 2026 11:56:17 +0800
Subject: [PATCH] avfilter/avf_showwaves: reject split_channels with fewer rows
than channels
With split_channels, each channel gets outlink->h / nb_channels rows.
If the height is smaller than the number of channels, that is 0, and
mode=line starts drawing at row -1, writing before the frame.
Such a configuration cannot draw anything, so reject it.
Signed-off-by: Martin Mirchev <[email protected]>
---
libavfilter/avf_showwaves.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libavfilter/avf_showwaves.c b/libavfilter/avf_showwaves.c
index dda15c53065..6aa0101bb39 100644
--- a/libavfilter/avf_showwaves.c
+++ b/libavfilter/avf_showwaves.c
@@ -408,6 +408,12 @@ static int config_output(AVFilterLink *outlink)
uint8_t x;
int ch;
+ if (showwaves->split_channels && showwaves->h < nb_channels) {
+ av_log(ctx, AV_LOG_ERROR,
+ "Image height must be at least the number of channels with
split_channels\n");
+ return AVERROR(EINVAL);
+ }
+
showwaves->q = av_make_q(0, 1);
showwaves->c = av_make_q(0, 1);
--
2.54.0
_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
