PR #24577 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24577 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24577.patch
Fixes: heap-use-after-free Fixes: BTOI3sLHWE0g Found-by: Joshua Rogers <[email protected]> >From 559fbc9921a8cc370d5454fb8f38bfb3f7749e64 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 20 Sep 2026 01:23:54 +0200 Subject: [PATCH 1/2] avutil/channel_layout: do not free a custom map the source still points to Fixes: heap-use-after-free Fixes: BTOI3sLHWE0g Found-by: Joshua Rogers <[email protected]> --- libavutil/channel_layout.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavutil/channel_layout.c b/libavutil/channel_layout.c index 53ac5cd56d..512c6b2487 100644 --- a/libavutil/channel_layout.c +++ b/libavutil/channel_layout.c @@ -449,6 +449,10 @@ void av_channel_layout_uninit(AVChannelLayout *channel_layout) int av_channel_layout_copy(AVChannelLayout *dst, const AVChannelLayout *src) { + if (dst == src) + return 0; + if (dst->order == AV_CHANNEL_ORDER_CUSTOM && dst->u.map == src->u.map) + dst->u.map = NULL; av_channel_layout_uninit(dst); *dst = *src; if (src->order == AV_CHANNEL_ORDER_CUSTOM) { -- 2.52.0 >From 76f06fd12e07b536a1831ba18716e54aad3fa24b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 19 Sep 2026 23:39:01 +0200 Subject: [PATCH 2/2] avutil/tests/opt: copy options into a memdup'ed object holding a custom channel layout --- libavutil/tests/opt.c | 23 +++++++++++++++++++++++ tests/ref/fate/opt | 3 +++ 2 files changed, 26 insertions(+) diff --git a/libavutil/tests/opt.c b/libavutil/tests/opt.c index 8ab76c4690..c5d1c73711 100644 --- a/libavutil/tests/opt.c +++ b/libavutil/tests/opt.c @@ -584,5 +584,28 @@ int main(void) printf("Error 'foo'\n"); } + printf("\nTesting av_opt_copy() into a memdup'ed object\n"); + { + TestContext test_ctx = { 0 }; + TestContext *copy; + uint8_t *layout_name = NULL; + + test_ctx.class = &test_class; + av_opt_set_defaults(&test_ctx); + av_opt_set(&test_ctx, "cl", "FL@Left+FR@Right", 0); + + copy = av_memdup(&test_ctx, sizeof(test_ctx)); + if (!copy) + return 1; + av_opt_copy(copy, &test_ctx); + av_opt_free(&test_ctx); + + av_opt_get(copy, "cl", 0, &layout_name); + printf("cl=%s\n", layout_name); + av_free(layout_name); + av_opt_free(copy); + av_free(copy); + } + return 0; } diff --git a/tests/ref/fate/opt b/tests/ref/fate/opt index 04e787f01d..173a78e7cc 100644 --- a/tests/ref/fate/opt +++ b/tests/ref/fate/opt @@ -518,3 +518,6 @@ Error 'num64' Error 'child_num' OK 'child_num' Error 'foo' + +Testing av_opt_copy() into a memdup'ed object +cl=2 channels (FL@Left+FR@Right) -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
