virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-02-04 06:08:26 +02:00
Code Issues Releases Activity

af_channelmap: sanity check input channel indices in all cases.

Browse Source 
Fixes invalid reads from non-existing channels.

CC:libav-stable@libav.org
This commit is contained in:
Anton Khirnov 2013-04-14 12:07:24 +02:00
parent 7f1fd97636
commit aafed1175d
1 changed files with 15 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
libavfilter/af_channelmap.c
View File

@ -356,23 +356,32 @@ static int channelmap_config_input(AVFilterLink *inlink)
{ {
AVFilterContext *ctx = inlink->dst; AVFilterContext *ctx = inlink->dst;
ChannelMapContext *s = ctx->priv; ChannelMapContext *s = ctx->priv;
int nb_channels = av_get_channel_layout_nb_channels(inlink->channel_layout);
int i, err = 0; int i, err = 0;
const char *channel_name; const char *channel_name;
char layout_name[256]; char layout_name[256];
if (s->mode == MAP_PAIR_STR_INT || s->mode == MAP_PAIR_STR_STR) { for (i = 0; i < s->nch; i++) {
for (i = 0; i < s->nch; i++) { if (s->mode == MAP_PAIR_STR_INT || s->mode == MAP_PAIR_STR_STR) {
s->map[i].in_channel_idx = av_get_channel_layout_channel_index( s->map[i].in_channel_idx = av_get_channel_layout_channel_index(
inlink->channel_layout, s->map[i].in_channel); inlink->channel_layout, s->map[i].in_channel);
if (s->map[i].in_channel_idx < 0) { }
if (s->map[i].in_channel_idx < 0 ||
s->map[i].in_channel_idx >= nb_channels) {
av_get_channel_layout_string(layout_name, sizeof(layout_name),
0, inlink->channel_layout);
if (s->map[i].in_channel) {
channel_name = av_get_channel_name(s->map[i].in_channel); channel_name = av_get_channel_name(s->map[i].in_channel);
av_get_channel_layout_string(layout_name, sizeof(layout_name),
0, inlink->channel_layout);
av_log(ctx, AV_LOG_ERROR, av_log(ctx, AV_LOG_ERROR,
"input channel '%s' not available from input layout '%s'\n", "input channel '%s' not available from input layout '%s'\n",
channel_name, layout_name); channel_name, layout_name);
err = AVERROR(EINVAL); } else {
av_log(ctx, AV_LOG_ERROR,
"input channel #%d not available from input layout '%s'\n",
s->map[i].in_channel_idx, layout_name);
} }
err = AVERROR(EINVAL);
} }
} }