[FFmpeg-devel] [PATCH 1/2] avfilter/af_stereowiden: Check length

[FFmpeg-devel] [PATCH 1/2] avfilter/af_stereowiden: Check length

[Michael Niedermayer]

Fixes: out of array access
Fixes: tickets/10746/poc13ffmpeg

Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/af_stereowiden.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavfilter/af_stereowiden.c b/libavfilter/af_stereowiden.c
index af4b23e8a57..f7a6a91ae40 100644
--- a/libavfilter/af_stereowiden.c
+++ b/libavfilter/af_stereowiden.c
@@ -74,6 +74,8 @@ static int config_input(AVFilterLink *inlink)
 
     s->length = s->delay * inlink->sample_rate / 1000;
     s->length *= 2;
+    if (s->length == 0)
+        return AVERROR(EINVAL);
     s->buffer = av_calloc(s->length, sizeof(*s->buffer));
     if (!s->buffer)
         return AVERROR(ENOMEM);
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/2] avfilter/f_reverse: Apply PTS compensation only when pts is available

[Michael Niedermayer]

Fixes: out of array access
Fixes: tickets/10753/poc16ffmpeg

Regression since: 45dc668aea0edac34969b5a1ff76cf9ad3a09be1
Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/f_reverse.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/libavfilter/f_reverse.c b/libavfilter/f_reverse.c
index 086819a207e..744f4a3cc83 100644
--- a/libavfilter/f_reverse.c
+++ b/libavfilter/f_reverse.c
@@ -266,7 +266,8 @@ static int areverse_request_frame(AVFilterLink *outlink)
         AVFrame *out = s->frames[s->nb_frames - 1];
         out->duration = s->duration[s->flush_idx];
         out->pts     = s->pts[s->flush_idx++] - s->nb_samples;
-        s->nb_samples += s->pts[s->flush_idx] - s->pts[s->flush_idx - 1] - out->nb_samples;
+        if (s->nb_frames > 1)
+            s->nb_samples += s->pts[s->flush_idx] - s->pts[s->flush_idx - 1] - out->nb_samples;
 
         if (av_sample_fmt_is_planar(out->format))
             reverse_samples_planar(out);
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avfilter/af_stereowiden: Check length

[Paul B Mahol]

This is highly suboptimal, use rounding-up.
See librempeg code.
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avfilter/af_stereowiden: Check length

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 406 bytes --]

On Sun, Dec 24, 2023 at 11:40:31AM +0100, Paul B Mahol wrote:
> This is highly suboptimal, use rounding-up.

changing the rounding does not fix the issue, a float can still
evaluate to 0 so 0 needs to be checked

thx

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

The educated differ from the uneducated as much as the living from the
dead. -- Aristotle 

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 2/2] avfilter/f_reverse: Apply PTS compensation only when pts is available

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 628 bytes --]

On Sun, Dec 24, 2023 at 02:49:49AM +0100, Michael Niedermayer wrote:
> Fixes: out of array access
> Fixes: tickets/10753/poc16ffmpeg
> 
> Regression since: 45dc668aea0edac34969b5a1ff76cf9ad3a09be1
> Found-by: Zeng Yunxiang
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavfilter/f_reverse.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)

will apply

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

"Nothing to hide" only works if the folks in power share the values of
you and everyone you know entirely and always will -- Tom Scott


[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".