1
0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-06-14 08:44:40 +02:00
Files
FFmpeg/libavfilter
Franciszek Kalinowski 7b280ef5e1 avfilter/af_join: fix wrong loop bound in buffer dedup (use-after-free)
try_push_frame() decides whether an input buffer is already tracked by testing
`j == i` (the channel index) instead of `j == nb_buffers`. Once an earlier
channel shared a buffer, nb_buffers falls behind i and a genuinely new buffer is
never referenced, so it is freed while the output frame still points at it.

Reported by Franciszek Kalinowski (isec.pl / striga.ai) and Bartosz Smigielski.

(cherry picked from commit 461fb22053)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-06-14 04:59:03 +02:00
..
2025-08-03 13:48:47 +02:00
2023-11-18 19:55:42 +01:00
2025-08-03 13:48:47 +02:00
2023-11-16 20:53:18 +02:00
2024-08-19 21:48:04 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2024-08-19 21:48:04 +02:00
2025-08-08 21:59:56 +02:00
2024-08-19 21:48:04 +02:00
2024-08-19 21:48:04 +02:00
2025-08-03 13:48:47 +02:00
2024-08-19 21:48:04 +02:00
2024-08-19 21:48:04 +02:00
2025-08-03 13:48:47 +02:00
2024-09-02 11:55:20 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2024-08-19 21:48:04 +02:00
2025-08-08 21:59:56 +02:00
2024-08-19 21:48:04 +02:00
2025-08-03 13:48:47 +02:00
2024-07-01 22:31:02 +02:00
2024-08-19 21:48:04 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2024-08-19 21:48:04 +02:00
2025-04-15 15:49:38 +02:00
2024-02-16 21:34:38 +01:00
2026-05-04 01:01:49 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2025-06-15 21:00:38 +05:30
2025-07-04 01:32:27 +02:00
2025-07-04 01:32:27 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2025-04-22 20:45:57 +02:00
2024-08-19 21:48:04 +02:00