diff mbox series

[FFmpeg-devel,4/4] avfilter/af_pan: check nb_output_channels before use

Message ID 20240611134422.3172010-4-michael@niedermayer.cc
State New
Headers show
Series [FFmpeg-devel,1/4] avfilter/af_aresample: Cleanup on av_channel_layout_copy() failure | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Michael Niedermayer June 11, 2024, 1:44 p.m. UTC 
Fixes: CID1500281 Out-of-bounds write
Fixes: CID1500331 Out-of-bounds write

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/af_pan.c | 8 ++++++++
 1 file changed, 8 insertions(+)
diff mbox series

Patch

diff --git a/libavfilter/af_pan.c b/libavfilter/af_pan.c
index 31c6be45c37..da32977c995 100644
--- a/libavfilter/af_pan.c
+++ b/libavfilter/af_pan.c
@@ -119,6 +119,14 @@  static av_cold int init(AVFilterContext *ctx)
     if (ret < 0)
         goto fail;
 
+    if (pan->nb_output_channels > MAX_CHANNELS) {
+        av_log(ctx, AV_LOG_ERROR,
+               "af_pan supports a maximum of %d channels. "
+               "Feel free to ask for a higher limit.\n", MAX_CHANNELS);
+        ret = AVERROR_PATCHWELCOME;
+        goto fail;
+    }
+
     /* parse channel specifications */
     while ((arg = arg0 = av_strtok(NULL, "|", &tokenizer))) {
         int used_in_ch[MAX_CHANNELS] = {0};