PR #24577 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24577
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24577.patch

Fixes: heap-use-after-free
Fixes: BTOI3sLHWE0g
Found-by: Joshua Rogers <[email protected]>


>From 559fbc9921a8cc370d5454fb8f38bfb3f7749e64 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Sun, 20 Sep 2026 01:23:54 +0200
Subject: [PATCH 1/2] avutil/channel_layout: do not free a custom map the
 source still points to

Fixes: heap-use-after-free
Fixes: BTOI3sLHWE0g
Found-by: Joshua Rogers <[email protected]>
---
 libavutil/channel_layout.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavutil/channel_layout.c b/libavutil/channel_layout.c
index 53ac5cd56d..512c6b2487 100644
--- a/libavutil/channel_layout.c
+++ b/libavutil/channel_layout.c
@@ -449,6 +449,10 @@ void av_channel_layout_uninit(AVChannelLayout 
*channel_layout)
 
 int av_channel_layout_copy(AVChannelLayout *dst, const AVChannelLayout *src)
 {
+    if (dst == src)
+        return 0;
+    if (dst->order == AV_CHANNEL_ORDER_CUSTOM && dst->u.map == src->u.map)
+        dst->u.map = NULL;
     av_channel_layout_uninit(dst);
     *dst = *src;
     if (src->order == AV_CHANNEL_ORDER_CUSTOM) {
-- 
2.52.0


>From 76f06fd12e07b536a1831ba18716e54aad3fa24b Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <[email protected]>
Date: Sat, 19 Sep 2026 23:39:01 +0200
Subject: [PATCH 2/2] avutil/tests/opt: copy options into a memdup'ed object
 holding a custom channel layout

---
 libavutil/tests/opt.c | 23 +++++++++++++++++++++++
 tests/ref/fate/opt    |  3 +++
 2 files changed, 26 insertions(+)

diff --git a/libavutil/tests/opt.c b/libavutil/tests/opt.c
index 8ab76c4690..c5d1c73711 100644
--- a/libavutil/tests/opt.c
+++ b/libavutil/tests/opt.c
@@ -584,5 +584,28 @@ int main(void)
             printf("Error 'foo'\n");
     }
 
+    printf("\nTesting av_opt_copy() into a memdup'ed object\n");
+    {
+        TestContext test_ctx = { 0 };
+        TestContext *copy;
+        uint8_t *layout_name = NULL;
+
+        test_ctx.class = &test_class;
+        av_opt_set_defaults(&test_ctx);
+        av_opt_set(&test_ctx, "cl", "FL@Left+FR@Right", 0);
+
+        copy = av_memdup(&test_ctx, sizeof(test_ctx));
+        if (!copy)
+            return 1;
+        av_opt_copy(copy, &test_ctx);
+        av_opt_free(&test_ctx);
+
+        av_opt_get(copy, "cl", 0, &layout_name);
+        printf("cl=%s\n", layout_name);
+        av_free(layout_name);
+        av_opt_free(copy);
+        av_free(copy);
+    }
+
     return 0;
 }
diff --git a/tests/ref/fate/opt b/tests/ref/fate/opt
index 04e787f01d..173a78e7cc 100644
--- a/tests/ref/fate/opt
+++ b/tests/ref/fate/opt
@@ -518,3 +518,6 @@ Error 'num64'
 Error 'child_num'
 OK    'child_num'
 Error 'foo'
+
+Testing av_opt_copy() into a memdup'ed object
+cl=2 channels (FL@Left+FR@Right)
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to