summaryrefslogtreecommitdiff
path: root/libavfilter
Commit message (Collapse)AuthorAgeFilesLines
* avfilter/vf_untile: swap the chroma shift values used for plane offsetsJames Almer2023-03-161-2/+2
| | | | | | | Fixes ticket #10265 Signed-off-by: James Almer <jamrial@gmail.com> (cherry picked from commit dc61d5cf195bc6de9263883c42a58348863e6d4f)
* avfilter/vf_showinfo: remove backspacesMichael Niedermayer2022-09-261-4/+7
| | | | | | | | They mess with storing editing and comparing the results Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 31581ae7ee6d007f2f2dcd16de5df991ba7aa1b6) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avfilter/vf_signature: Fix integer overflow in filter_frame()Michael Niedermayer2022-09-261-2/+2
| | | | | | | | | | Fixes: CID1403233 The second of the 2 changes may be unneeded but will help coverity Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit dd6040675ec18d19429f882caea6bb306ed6677a) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avfilter/vsrc_mandelbrot: Check for malloc failureMichael Niedermayer2022-09-261-0/+3
| | | | | | | Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit fbd22504c4148d2a01ccfe38df26c144f56db76b) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avfilter/vf_frei0r: Copy to frame allocated according to frei0r requirementsMichael Niedermayer2022-09-261-6/+16
| | | | | | | | | Fixes: issues with non trivial linesize Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit d353909e773ba8a8201fa13d6c35251351dd567a) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avfilter/video: Add ff_default_get_video_buffer2() to set specific alignmentMichael Niedermayer2022-09-262-1/+7
| | | | | | | Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit d74078270198b97fdda258840f0d501a3ffcc693) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avfilter/vf_subtitles: pass storage size to libassOneric2022-04-061-1/+8
| | | | | Due to a quirk of the ASS format some tags depend on the exact storage resolution of the video, so tell libass via ass_set_storage_size.
* avfilter/scale_npp: fix non-aligned output frame dimensionsTimo Rothenpieler2021-10-071-1/+4
|
* avfilter/af_drmeter: Check that there is dataMichael Niedermayer2021-10-061-0/+5
| | | | | | | | | | Fixes: floating point division by 0 Fixes: -nan is outside the range of representable values of type 'int' Fixes: Ticket8307 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 4f49fa6abe89e2fca2585cac4c63190315972cf0) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avfilter/vf_fftdnoiz: Use lrintf() in export_row8()Michael Niedermayer2021-10-061-1/+1
| | | | | | | | | Fixes: 1.04064e+10 is outside the range of representable values of type 'int' Fixes: Ticket 8279 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 1f21349d20d9bda8eeeddb23263892be0cea12e3) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avfilter/vf_mestimate: Check b_countMichael Niedermayer2021-10-061-0/+3
| | | | | | | | | Fixes: left shift of negative value -1 Fixes: Ticket8270 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 06af6e101bbd04e8ecc5337bc3b6894a5e058e14) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avfilter/vf_dctdnoiz: Check threadsMichael Niedermayer2021-10-061-0/+3
| | | | | | | | | Fixes: floating point division by 0 Fixes: Ticket 8269 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 4a3917c02c428b11128ac3d4a01b780ea44aa53c) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avfilter/vf_ciescope: Fix undefined behavior in rgb_to_xy() with blackMichael Niedermayer2021-10-061-1/+2
| | | | | | | | | | Fixes: floating point division by 0 Fixes: undefined behavior in handling NaN Fixes: Ticket 8268 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 3d500e62f6206ad11308b18976246366aed8c1a5) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avfilter/vf_yadif: Fix handing of tiny imagesMichael Niedermayer2021-10-061-14/+18
| | | | | | | | | | Fixes: out of array access Fixes: Ticket8240 Fixes: CVE-2020-22021 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 7971f62120a55c141ec437aa3f0bacc1c1a3526b) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avfilter/vf_vmafmotion: Check dimensionsMichael Niedermayer2021-10-061-0/+3
| | | | | | | | | | | | Fixes: out of array access Fixes: Ticket8241 Fixes: Ticket8246 Fixes: CVE-2020-22019 Fixes: CVE-2020-22033 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 82ad1b76751bcfad5005440db48c46a4de5d6f02) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avfilter/vf_scale: Fix adding 0 to NULL (which is UB) in scale_slice()Michael Niedermayer2021-10-061-2/+2
| | | | | | | Found-by: Jeremy Leconte <jleconte@google.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 1cf96ce269364e3c2b4ec2097f121ad42b336839) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
* avfilter/overlay_cuda: check av_buffer_ref resultTimo Rothenpieler2021-04-111-0/+4
|
* avfilter/overlay_cuda: hold explicit reference to hw_device_ctxTimo Rothenpieler2021-04-111-1/+7
|
* avfilter/overlay_cuda: fix framesync with embedded PGS subtitlenyanmisaka2021-03-251-1/+4
| | | | Signed-off-by: nyanmisaka <nst799610810@gmail.com>
* avfilter/af_headphone: Fix stack buffer overflowAndreas Rheinhardt2021-02-271-1/+1
| | | | | | | | The number of channels can be up to 64, not only 16. Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 58b6594b01e37ebf3daa2cb66183287a1f1b0a78)
* avfilter/af_headphone: Don't overrun arrayAndreas Rheinhardt2021-02-271-4/+10
| | | | | | | | | | | | | The headphone filter stores the channel position of the ith HRIR stream in the ith element of an array of 64 elements; but because there is no check for duplicate channels, it is easy to write beyond the end of the array by simply repeating channels. This commit adds a check for duplicate channels to rule this out. Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 14226be499d27935d54981f0a6e1b15fd65746cd)
* avfilter/af_headphone: Fix segfault when using very short streamsAndreas Rheinhardt2021-02-271-0/+3
| | | | | | | | | | | | | | | | | | | | | When the headphone filter does its processing in the time domain, the lengths of the buffers involved are determined by three parameters, only two of which are relevant here: ir_len and air_len. The former is the length (in samples) of the longest HRIR input stream and the latter is the smallest power-of-two bigger than ir_len. Using optimized functions to calculate the convolution places restrictions on the alignment of the length of the vectors whose scalar product is calculated. Therefore said length, namely ir_len, is aligned on 32; but the number of elements of the buffers used is given by air_len and for ir_len < 16 a buffer overflow happens. This commit fixes this by ensuring that air_len is always >= 32 if processing happens in the time domain. Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 7b74e02ef2d0099a2e1f1d1cefc1fce2e041f618)
* avfilter/af_headphone: Check for the existence of samplesAndreas Rheinhardt2021-02-271-1/+7
| | | | | | | | | | | Not providing any samples makes no sense at all. And if no samples were provided for one of the HRIR streams, one would either run into an av_assert1 in ff_inlink_consume_samples() or into a segfault in take_samples() in avfilter.c. Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit dfd46e2d160afcb7e453d0e2394a6978cb447712)
* avfilter/af_headphone: Remove always true checkAndreas Rheinhardt2021-02-271-2/+0
| | | | | | Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 709fca0a9415ea97cd1d49d67298b8c8728a7aec)
* avfilter/af_headphone: Don't use uninitialized buffer in log messageAndreas Rheinhardt2021-02-271-1/+1
| | | | | | | | | | | | | | | | This buffer was supposed to be initialized by sscanf(input, "%7[A-Z]%n", buf, &len), yet if the first input character is not in the A-Z range, buf is not touched (in particular it needn't be zero-terminated if the failure happened when parsing the first channel and it still contains the last channel name if the failure happened when one channel name could be successfully parsed). This is treated as error in which case buf is used directly in the log message. This commit fixes this by actually using the string that could not be matched in the log message instead. Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit e2d4a5807fa5914185dc6f3ae0a4d63cd8fe3b29)
* avfilter/vf_minterpolate: Fix left shift of negative valueAndreas Rheinhardt2021-02-271-12/+15
| | | | | | | | | | | | | This has happened when initializing the motion estimation context if width or height of the video was smaller than the block size used for motion estimation and if the motion interpolation mode indicates not to use motion estimation. The solution is of course to only initialize the motion estimation context if the interpolation mode uses motion estimation. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit aa262dcce850e7d0361bb6c78d833f7249543712)
* avfilter/vf_minterpolate: Reject too small dimensionsAndreas Rheinhardt2021-02-271-0/+5
| | | | | | | | | | | The latter code relies upon the dimensions to be not too small; otherwise one will call av_clip() with min > max lateron which aborts in case ASSERT_LEVEL is >= 2 or one will get a nonsense result that may lead to a heap-buffer-overflow/underflow. The latter has happened in ticket #8248 which this commit fixes. Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit bb13cdbe279d92f595243a9b3e2b91fb48cf146c)
* avfilter/vf_subtitles: Fix leaks on failureAndreas Rheinhardt2021-02-271-4/+8
| | | | | | | | | | | | | | init_subtitles() sometimes returned directly upon error without cleaning up after itself. The easiest way to trigger this is by using picture-based subtitles; it is also possible to run into this in case of missing decoders or allocation failures. Furthermore, return the proper error code in case of missing decoder. Reviewed-by: Nicolas George <george@nsup.org> Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 77ace1ffea6bd40d44326c1a87a55db0937877f1)
* avfilter/vf_uspp: Fix potential leak of dict on errorAndreas Rheinhardt2021-02-271-1/+1
| | | | | | Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 8443848dfc632334439d4eae7e446167682a4ddb)
* avfilter/lavfutils: Fix memleak when avformat_find_stream_info() failsAndreas Rheinhardt2021-02-271-1/+1
| | | | | | | Reviewed-by: Paul B Mahol <onemda@gmail.com> Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit f38926ec24247d5e7365f0c5e73a5db43146f5a1)
* avfilter/lavfutils: Don't use uninitialized pointers for freeingAndreas Rheinhardt2021-02-271-2/+2
| | | | | | | | | Happened on several error conditions, e.g. if there is just no decoder for the format (like with svg images). Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 3d1a9824b8e7f5ad52447cc2d60beffc9e66ff67)
* avfilter/af_headphone: Fix leak of channel layouts list on errorAndreas Rheinhardt2021-02-271-4/+3
| | | | | | | | | | | In case the multichannel HRIR mode was enabled, an error could happen between allocating a channel layouts list and attaching it to its target destination. If an error happened, the list would leak. This is fixed by attaching the list to its target directly after its allocation. Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit ca8e5dedc7fabae3df76ea11d9952070cbb19620)
* avfilter/af_headphone: Fix segfault upon allocation failureAndreas Rheinhardt2021-02-271-5/+2
| | | | | | | | | | | | | | | The headphone filter uses a variable number of inpads and allocates them in its init function; if all goes well, the number of inpads coincides with a number stored in the filter's private context. Yet if allocating a subsequent inpad fails, the uninit function nevertheless uses the number stored in the private context to determine the number of inpads to free and not the AVFilterContext's nb_inputs. This will lead to an access beyond the end of the allocated AVFilterContext.input_pads array and an invalid free. Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 0960da42f5414a24497c75787ff4be318ae41421)
* avfilter/vf_signature: Fix leak of string upon errorAndreas Rheinhardt2021-02-271-5/+4
| | | | | | | | | | If an error happens between allocating a string intended to be used as an inpad's name and attaching it to its input pad, the string leaks. Fix this by inserting the inpad directly after allocating its string. Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 16ea88778e6f4e2d49318ea6e02fa938ac2f401e)
* avfilter/vf_signature: Fix leak of inpads' namesAndreas Rheinhardt2021-02-271-0/+2
| | | | | | Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 37838417b8045fa3a49acc55546c741d3f2ac602)
* avfilter/af_aiir: Fix segfault and leak upon allocation failureAndreas Rheinhardt2021-02-271-10/+2
| | | | | | | | | | | | | | | | | | | | | | The aiir filter adds output pads in its init function. Each of these output pads had a name which was allocated and to be freed in the uninit function. Given that the aiir filter has between one and two outputs, one output pad's name was freed unconditionally and a second was freed conditionally. Yet if adding output pads fails, there are no output pads at all and trying to free a nonexistent pad's name will lead to a segfault. Furthermore, if the name could be successfully allocated, yet adding the new pad fails, the name would leak. This commit fixes this by not allocating the pads' names at all any more: They are constant anyway. This allows to remove the code to free them and hence fixes the aforementioned bugs. Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 97b1a2c564e0d4dbf8573b4647ae110a75238db3)
* avfilter/vf_premultiply: Fix leak of names of inpadsAndreas Rheinhardt2021-02-271-12/+4
| | | | | | | | | | These names leak because freeing them in the uninit function has been forgotten. Instead of adding the freeing code, this commit stops allocating these names. They are constants anyway. Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 7e736cd38aed1886fcc9672848ccf31ea1cc0b28)
* avfilter/af_anequalizer: Fix memleak when inserting pad failsAndreas Rheinhardt2021-02-271-10/+6
| | | | | | | | | | | It has been forgotten to free the name of the second outpad if attaching the first one to the AVFilterContext fails. Fixing this is easy: Only prepare the second outpad after (and if) the first outpad has been successfully attached to the AVFilterContext. Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit fdbd579fd10bc80c0f4e5a86497a4aa2e00317c5)
* avfilter/af_amerge: Fix segfault upon allocation failureAndreas Rheinhardt2021-02-271-5/+2
| | | | | | | | | | | | | | | The amerge filter uses a variable number of inpads and allocates them in its init function; if all goes well, the number of inpads coincides with a number stored in the filter's private context. Yet if allocating a subsequent inpad fails, the uninit function nevertheless uses the number stored in the private context to determine the number of inpads to free and not the AVFilterContext's nb_inputs. This will lead to an access beyond the end of the allocated AVFilterContext.input_pads array and an invalid free. Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 8f2c1f2cbe77685435362f1940b637a6c3ff1934)
* avfilter/af_aformat: Add uninit functionAndreas Rheinhardt2021-02-271-1/+15
| | | | | | | | | | Fixes memleaks in case init fails (e.g. because of invalid parameters like 'aformat=sample_fmts=s16:cl=wtf') or also if query_formats is never called. Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit a7bd37927628df3672488e07f718b3549bea717d)
* avfilter/vf_hwdownload: Fix leak of formats list upon errorAndreas Rheinhardt2021-02-271-18/+5
| | | | | | | | | | | | | | If adding the list of input formats to its AVFilterLink fails, the list of output formats (which has not been attached to permanent storage yet) leaks. This has been fixed by not creating the lists of in- and output formats simultaneously. Instead creating said lists is relegated to ff_formats_pixdesc_filter() (this also avoids the reallocations implicit in using ff_add_format()) and the second list is only created after (and if) the first list has been permanently attached to its AVFilterLink. Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 257cd5fa389465032b2b222fff5ada9dfebeb4d0)
* avfilter/formats: Fix double frees and memleaks on errorAndreas Rheinhardt2021-02-271-22/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The formats API deals with lists of channel layouts, sample rates, pixel formats and sample formats. These lists are refcounted in a way in which the list structure itself contains pointers to all of its owners. Furthermore, it is possible for a list to be not owned by anyone yet; this status is temporary until the list has been attached to an owner. Adding an owner to a list involves reallocating the list's list of owners and can therefore fail. In order to reduce the amount of checks and cleanup code for the users of this API, the API is supposed to be lenient when faced with input lists that are NULL and it is supposed to clean up if adding an owner to a list fails, so that a simple use case like list = ff_make_format_list(foo_fmts); if ((ret = ff_formats_ref(list, &ctx->inputs[0]->out_formats)) < 0) return ret; needn't check whether list could be successfully allocated (ff_formats_ref() return AVERROR(ENOMEM) if it couldn't) and it also needn't free list if ff_formats_ref() couldn't add an owner for it. But the cleaning up after itself was broken. The root cause was that the refcount was decremented during unreferencing whether or not the element to be unreferenced was actually an owner of the list or not. This means that if the above sample code is continued by if ((ret = ff_formats_ref(list, &ctx->inputs[1]->out_formats)) < 0) return ret; and that if an error happens at the second ff_formats_ref() call, the automatic cleaning of list will decrement the refcount from 1 (the sole owner of list at this moment is ctx->input[0]->out_formats) to 0 and so the list will be freed; yet ctx->input[0]->out_formats still points to the list and this will lead to a double free/use-after-free when ctx->input[0] is freed later. Presumably in order to work around such an issue, commit 93afb338a405eac0f9e7b092bc26603378bfcca6 restricted unreferencing to lists with owners. This does not solve the root cause (the above example is not fixed by this) at all, but it solves some crashs. This commit fixes the API: The list's refcount is only decremented if an owner is removed from the list of owners and not if the unref-function is called with a pointer that is not among the owners of the list. Furtermore, the requirement for the list to have owners is dropped. This implies that if the first call to ff_formats_ref() in the above example fails, the refcount which is initially zero during unreferencing is not modified, so that the list will be freed automatically in said call to ff_formats_ref() as every list whose refcount reaches zero is. If on the other hand, the second call to ff_formats_ref() is the first to fail, the refcount would stay at one during the automatic unreferencing in ff_formats_ref(). The list would later be freed when its last (and in this case sole) owner (namely ctx->inputs[0]->out_formats) gets unreferenced. The issues described here for ff_formats_ref() also affected the other functions of this API. E.g. ff_add_format() failed to clean up after itself if adding an entry to an already existing list failed (the case of a freshly allocated list was handled specially and this commit also removes said code). E.g. ff_all_formats() inherited the flaw. Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 2a471af50aab02e8bb062c84a5779c7de1952fc0)
* avfilter/af_channelmap: Fix double-free of AVFilterChannelLayouts on errorAndreas Rheinhardt2021-02-271-17/+7
| | | | | | | | | | | | | | | | | | | | | | The query_formats function of the channelmap filter tries to allocate a list of channel layouts which on success are attached to more permanent objects (an AVFilterLink) for storage afterwards. If attaching succeeds, the link becomes one of the common owners (in this case, the only owner) of the list. Yet if the list has been successfully attached to the link and an error happens lateron, the list was manually freed, which is wrong, because it is owned by its link so that the link's pointer to the list will become dangling and there will be a double-free/use-after-free when the link is later cleaned up automatically. This commit fixes this by removing the custom freeing code; this will temporarily add a leaking codepath (if attaching the list fails, the list will leak), but this will be fixed soon by making sure that an AVFilterChannelLayouts without owner will be automatically freed when attaching it to an AVFilterLink fails. Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 44bcd6f74922ba490e680e79eae897b249c29d62)
* avfilter/vf_alphamerge: Fix double-free of AVFilterFormats on errorAndreas Rheinhardt2021-02-271-19/+7
| | | | | | | | | | | | | | | | | | | | | | | | The query_formats function of the alphamerge filter tries to allocate two lists of formats which on success are attached to more permanent objects (AVFilterLinks) for storage afterwards. If attaching a list to an AVFilterLink succeeds, the link becomes one of the owners of the list. Yet if attaching a list to one of its links succeeds and an error happens lateron, both lists were manually freed, which is wrong if the list is already owned by one or more links; these links' pointers to their lists will become dangling and there will be a double-free/use- after-free when these links are cleaned up automatically. This commit fixes this by removing the custom freeing code; this will temporarily add a leaking codepath (if attaching a list not already owned by a link to a link fails, the list will leak), but this will be fixed soon by making sure that an AVFilterFormats without owner will be automatically freed when attaching it to an AVFilterLink fails. At most one list leaks because as of this commit a new list is only allocated after the old list has been successfully attached to a link. Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit fd1a2a54a478462212b25753e7106c13af1e33c6)
* avfilter/vf_overlay: Fix double-free of AVFilterFormats on errorAndreas Rheinhardt2021-02-271-51/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | The query_formats function of the overlay filter tries to allocate two lists (only one in a special case) of formats which on success are attached to more permanent objects (AVFilterLinks) for storage afterwards. If attaching a list to an AVFilterLink succeeds, it is in turn owned by the AVFilterLink (or more exactly, the AVFilterLink becomes one of the common owners of the list). Yet if attaching a list to one of its links succeeds and an error happens lateron, both lists were manually freed, whic is wrong if the list is already owned by one or more links; these links' pointers to their lists will become dangling and there will be a double-free/use-after-free when these links are cleaned up automatically. This commit fixes this by removing the custom freeing code; this will temporarily add a leaking codepath (if attaching a list not already owned by a link to a link fails, the list will leak), but this will be fixed soon by making sure that an AVFilterFormats without owner will be automatically freed when attaching it to an AVFilterLink fails. Notice that at most one list leaks because a new list is only allocated after the old list has been successfully attached to a link. Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit a86ee5fd79840dc4af3e3f5c90ff8ce19b9ae993)
* avfilter/vf_remap: Fix double-free of AVFilterFormats on errorAndreas Rheinhardt2021-02-271-17/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | The query_formats function of the remap filter tries to allocate two lists of formats which on success are attached to more permanent objects (AVFilterLinks) for storage afterwards. If attaching a list to an AVFilterLink succeeds, it is in turn owned by the AVFilterLink (or more exactly, the AVFilterLink becomes one of the common owners of the list). Yet if attaching a list to one of its links succeeds and an error happens lateron, both lists were manually freed, which means that is wrong if the list is already owned by one or more links; these links' pointers to their lists will become dangling and there will be a double-free/use-after- free when these links are cleaned up automatically. This commit fixes this by removing the custom free code; this will temporarily add a leaking codepath (if attaching a list not already owned by a link to a link fails, the list will leak), but this will be fixed soon by making sure that an AVFilterFormats without owner will be automatically freed when attaching it to an AVFilterLink fails. Notice at most one list leaks because a new list is only allocated after the old list has been successfully attached to a link. Reviewed-by: Nicolas George <george@nsup.org> Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 07240c36c2912cea96dd9d11c8e3ed27995a2b3c)
* avfilter/vf_showpalette: Fix double-free of AVFilterFormats on errorAndreas Rheinhardt2021-02-271-19/+6
| | | | | | | | | | | | | | | | | | | | | | | | The query_formats function of the showpalette filter tries to allocate two lists of formats which on success are attached to more permanent objects (AVFilterLinks) for storage afterwards. If attaching a list to an AVFilterLink succeeds, the link becomes one (in this case the only one) of the owners of the list. Yet if attaching the first list to its link succeeds and attaching the second list fails, both lists were manually freed, which means that the first link's pointer to the first list becomes dangling and there will be a double-free when the first link is cleaned up automatically. This commit fixes this by removing the custom free code; this will temporarily add a leaking codepath (if attaching a list to a link fails, the list will leak), but this will be fixed shortly by making sure that an AVFilterFormats without owner will be automatically freed when attaching it to an AVFilterLink fails. Notice at most one list leaks because as of this commit a new list is only allocated after the old list has been successfully attached to a link. Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 76909c97c68c79d3c0353de83418a112595e9798)
* avfilter/af_amix: Fix double-free of AVFilterChannelLayouts on errorAndreas Rheinhardt2021-02-271-15/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | The query_formats function of the amix filter tries to allocate a list of channel layouts which are attached to more permanent objects (an AVFilter's links) for storage afterwards on success. If attaching a list to a link succeeds, the link becomes one of the common owners of the list. Yet if a list has been successfully attached to links (or if there were no links to attach it to in which case ff_set_common_channel_layouts() already frees the list) and an error happens lateron, the list was manually freed, which is wrong, because the list has either already been freed or it is owned by its links in which case these links' pointers to their list will become dangling and there will be double-frees/uses-after-free when these links are cleaned up automatically. This commit fixes this by removing the custom freeing code; this is made possible by using the list in ff_set_common_channel_layouts() directly after its allocation (without anything that can fail in between). Notice that ff_set_common_channel_layouts() is buggy itself which can lead to double-frees on error. This is not fixed in this commit. Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 44e376500fd0a5e6b9ca1611e645feeb50de1ac5)
* avfilter/af_amix: Don't needlessly reallocate tableAndreas Rheinhardt2021-02-271-6/+6
| | | | | | | | | | | | Replace using ff_add_format() repeatedly by a single call to ff_make_format_list(). (Right now this also fixes a memleak: If the first ff_add_format() succeeds and a subsequent call fails, the list leaks.) Reviewed-by: Paul B Mahol <onemda@gmail.com> Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit 27f35fd121e38b28daafb4f1ad47cf55b5e5ab71)
* avfilter/vf_vpp_qsv: Fix leak of AVFilterFormats on errorAndreas Rheinhardt2021-02-271-9/+4
| | | | | | | | | | | | | | The vpp_qsv's query_formats function allocated two AVFilterFormats, before storing them permanently. If storing the first of them fails, the function simply returns and the second leaks. This has been fixed by only allocating the second AVFilterFormats structure after the first one has been successfully stored. Fixes Coverity issue #1422231. Reviewed-by: Nicolas George <george@nsup.org> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com> (cherry picked from commit c4beb0783bd2470edbcc8da9e264c7fe1c10d7cc)
View Lorry Controller Status