This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/5.1 in repository ffmpeg.
commit 8a53022b29846eed407405b1e5d47dd252e42ca7 Author: Michael Niedermayer <[email protected]> AuthorDate: Tue Feb 3 22:06:24 2026 +0100 Commit: Michael Niedermayer <[email protected]> CommitDate: Tue May 5 15:21:03 2026 +0200 swresample: Check user chlayout in swr_set_matrix() All callers in FFmpeg check this already, but it is a public function that can plausibly be given more channels. In which case out of array writes would occur This is likely a regression from when channel layouts where extended to support more than 64 channels Found-by: 이동준 <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 906e3edc704f0680b598fb7bd446f22a79713368) Signed-off-by: Michael Niedermayer <[email protected]> --- libswresample/rematrix.c | 5 ++++- libswresample/swresample.c | 28 ++++++++++++++++------------ libswresample/swresample_internal.h | 1 + 3 files changed, 21 insertions(+), 13 deletions(-) diff --git a/libswresample/rematrix.c b/libswresample/rematrix.c index fe823dc575..09f298b0a0 100644 --- a/libswresample/rematrix.c +++ b/libswresample/rematrix.c @@ -66,7 +66,10 @@ int swr_set_matrix(struct SwrContext *s, const double *matrix, int stride) int nb_in, nb_out, in, out; int user_in_chlayout_nb_channels, user_out_chlayout_nb_channels; - if (!s || s->in_convert) // s needs to be allocated but not initialized + if (!s || s->in_convert || // s needs to be allocated but not initialized + swri_check_chlayout(s, &s->user_in_chlayout , "input") || + swri_check_chlayout(s, &s->user_out_chlayout, "output") + ) return AVERROR(EINVAL); memset(s->matrix, 0, sizeof(s->matrix)); memset(s->matrix_flt, 0, sizeof(s->matrix_flt)); diff --git a/libswresample/swresample.c b/libswresample/swresample.c index 5f293c16b6..52874401b5 100644 --- a/libswresample/swresample.c +++ b/libswresample/swresample.c @@ -29,6 +29,20 @@ #define ALIGN 32 +int swri_check_chlayout(struct SwrContext *s, const AVChannelLayout *chl, const char *name) { + char l1[1024]; + int ret; + + if (!(ret = av_channel_layout_check(chl)) || chl->nb_channels > SWR_CH_MAX) { + if (ret) + av_channel_layout_describe(chl, l1, sizeof(l1)); + av_log(s, AV_LOG_WARNING, "%s channel layout \"%s\" is invalid or unsupported.\n", name, ret ? l1 : ""); + return AVERROR(EINVAL); + } + + return 0; +} + int swr_set_channel_mapping(struct SwrContext *s, const int *channel_map){ if(!s || s->in_convert) // s needs to be allocated but not initialized return AVERROR(EINVAL); @@ -265,19 +279,9 @@ av_cold int swr_init(struct SwrContext *s){ s->out.ch_count = s-> user_out_chlayout.nb_channels; s-> in.ch_count = s-> user_in_chlayout.nb_channels; - if (!(ret = av_channel_layout_check(&s->user_in_chlayout)) || s->user_in_chlayout.nb_channels > SWR_CH_MAX) { - if (ret) - av_channel_layout_describe(&s->user_in_chlayout, l1, sizeof(l1)); - av_log(s, AV_LOG_WARNING, "Input channel layout \"%s\" is invalid or unsupported.\n", ret ? l1 : ""); - return AVERROR(EINVAL); - } - - if (!(ret = av_channel_layout_check(&s->user_out_chlayout)) || s->user_out_chlayout.nb_channels > SWR_CH_MAX) { - if (ret) - av_channel_layout_describe(&s->user_out_chlayout, l2, sizeof(l2)); - av_log(s, AV_LOG_WARNING, "Output channel layout \"%s\" is invalid or unsupported.\n", ret ? l2 : ""); + if (swri_check_chlayout(s, &s->user_in_chlayout , "input") || + swri_check_chlayout(s, &s->user_out_chlayout, "output")) return AVERROR(EINVAL); - } ret = av_channel_layout_copy(&s->in_ch_layout, &s->user_in_chlayout); ret |= av_channel_layout_copy(&s->out_ch_layout, &s->user_out_chlayout); diff --git a/libswresample/swresample_internal.h b/libswresample/swresample_internal.h index 262a0e2b8c..372af9c702 100644 --- a/libswresample/swresample_internal.h +++ b/libswresample/swresample_internal.h @@ -193,6 +193,7 @@ struct SwrContext { av_warn_unused_result int swri_realloc_audio(AudioData *a, int count); +int swri_check_chlayout(struct SwrContext *s, const AVChannelLayout *chl, const char *name); void swri_noise_shaping_int16 (SwrContext *s, AudioData *dsts, const AudioData *srcs, const AudioData *noises, int count); void swri_noise_shaping_int32 (SwrContext *s, AudioData *dsts, const AudioData *srcs, const AudioData *noises, int count); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
