diff options
| author | Andreas Rheinhardt <andreas.rheinhardt@gmail.com> | 2020-08-24 05:26:57 +0200 |
|---|---|---|
| committer | Andreas Rheinhardt <andreas.rheinhardt@gmail.com> | 2021-02-27 07:20:57 +0100 |
| commit | 42d160ac40f69f65113db108614659a365cebb9d (patch) | |
| tree | eb5a1cc25e87194c4c3c9d0bd2a4b08012cf4506 /libavfilter | |
| parent | b343188cd866f6fda1b248ac2a098fb0729492c2 (diff) | |
| download | ffmpeg-42d160ac40f69f65113db108614659a365cebb9d.tar.gz | |
avfilter/af_headphone: Fix segfault upon allocation failure
The headphone filter uses a variable number of inpads and allocates them
in its init function; if all goes well, the number of inpads coincides
with a number stored in the filter's private context. Yet if allocating a
subsequent inpad fails, the uninit function nevertheless uses the number
stored in the private context to determine the number of inpads to free
and not the AVFilterContext's nb_inputs. This will lead to an access
beyond the end of the allocated AVFilterContext.input_pads array and
an invalid free.
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit 0960da42f5414a24497c75787ff4be318ae41421)
Diffstat (limited to 'libavfilter')
| -rw-r--r-- | libavfilter/af_headphone.c | 7 |
1 files changed, 2 insertions, 5 deletions
diff --git a/libavfilter/af_headphone.c b/libavfilter/af_headphone.c index 552ad84837..751f4ab53d 100644 --- a/libavfilter/af_headphone.c +++ b/libavfilter/af_headphone.c @@ -812,7 +812,6 @@ static int config_output(AVFilterLink *outlink) static av_cold void uninit(AVFilterContext *ctx) { HeadphoneContext *s = ctx->priv; - int i; av_fft_end(s->ifft[0]); av_fft_end(s->ifft[1]); @@ -834,11 +833,9 @@ static av_cold void uninit(AVFilterContext *ctx) av_freep(&s->data_hrtf[1]); av_freep(&s->fdsp); - for (i = 0; i < s->nb_inputs; i++) { - if (ctx->input_pads && i) - av_freep(&ctx->input_pads[i].name); - } av_freep(&s->in); + for (unsigned i = 1; i < ctx->nb_inputs; i++) + av_freep(&ctx->input_pads[i].name); } #define OFFSET(x) offsetof(HeadphoneContext, x) |