diff mbox series

[FFmpeg-devel,1/2] avfilter/af_stereowiden: Check length

Message ID 20231224014949.18449-1-michael@niedermayer.cc
State New
Headers show
Series [FFmpeg-devel,1/2] avfilter/af_stereowiden: Check length | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Michael Niedermayer Dec. 24, 2023, 1:49 a.m. UTC 
Fixes: out of array access
Fixes: tickets/10746/poc13ffmpeg

Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/af_stereowiden.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Paul B Mahol Dec. 24, 2023, 10:40 a.m. UTC | #1 
This is highly suboptimal, use rounding-up.
See librempeg code.
Michael Niedermayer Dec. 29, 2023, 6:32 p.m. UTC | #2 
On Sun, Dec 24, 2023 at 11:40:31AM +0100, Paul B Mahol wrote:
> This is highly suboptimal, use rounding-up.

changing the rounding does not fix the issue, a float can still
evaluate to 0 so 0 needs to be checked

thx

[...]
diff mbox series

Patch

diff --git a/libavfilter/af_stereowiden.c b/libavfilter/af_stereowiden.c
index af4b23e8a57..f7a6a91ae40 100644
--- a/libavfilter/af_stereowiden.c
+++ b/libavfilter/af_stereowiden.c
@@ -74,6 +74,8 @@  static int config_input(AVFilterLink *inlink)
 
     s->length = s->delay * inlink->sample_rate / 1000;
     s->length *= 2;
+    if (s->length == 0)
+        return AVERROR(EINVAL);
     s->buffer = av_calloc(s->length, sizeof(*s->buffer));
     if (!s->buffer)
         return AVERROR(ENOMEM);