You've already forked FFmpeg
							
							
				mirror of
				https://github.com/FFmpeg/FFmpeg.git
				synced 2025-10-30 23:18:11 +02:00 
			
		
		
		
	avfilter/af_pan: check nb_output_channels before use
Fixes: CID1500281 Out-of-bounds write
Fixes: CID1500331 Out-of-bounds write
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 5fe8bf4aa5)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
			
			
This commit is contained in:
		| @@ -118,6 +118,14 @@ static av_cold int init(AVFilterContext *ctx) | |||||||
|     if (ret < 0) |     if (ret < 0) | ||||||
|         goto fail; |         goto fail; | ||||||
|  |  | ||||||
|  |     if (pan->nb_output_channels > MAX_CHANNELS) { | ||||||
|  |         av_log(ctx, AV_LOG_ERROR, | ||||||
|  |                "af_pan supports a maximum of %d channels. " | ||||||
|  |                "Feel free to ask for a higher limit.\n", MAX_CHANNELS); | ||||||
|  |         ret = AVERROR_PATCHWELCOME; | ||||||
|  |         goto fail; | ||||||
|  |     } | ||||||
|  |  | ||||||
|     /* parse channel specifications */ |     /* parse channel specifications */ | ||||||
|     while ((arg = arg0 = av_strtok(NULL, "|", &tokenizer))) { |     while ((arg = arg0 = av_strtok(NULL, "|", &tokenizer))) { | ||||||
|         int used_in_ch[MAX_CHANNELS] = {0}; |         int used_in_ch[MAX_CHANNELS] = {0}; | ||||||
|   | |||||||
		Reference in New Issue
	
	Block a user