On 4/29/2024 9:48 PM, Michael Niedermayer wrote:
Fixes: division by 0 Fixes: decoder modifying demuxer channels on failure Fixes: -sseof -5 -i zgclab/ffmpeg_crash/poc3Found-by: Wang Dawei and Zhou Geng, from Zhongguancun Laboratory Signed-off-by: Michael Niedermayer <mich...@niedermayer.cc> --- libavutil/opt.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavutil/opt.c b/libavutil/opt.c index ecbf7efe5fb..24c08e4bc06 100644 --- a/libavutil/opt.c +++ b/libavutil/opt.c @@ -132,9 +132,11 @@ static void opt_free_elem(const AVOption *o, void *ptr) av_dict_free((AVDictionary **)ptr); break;- case AV_OPT_TYPE_CHLAYOUT:+ case AV_OPT_TYPE_CHLAYOUT: { + int nb_channels = ((AVChannelLayout *)ptr)->nb_channels; av_channel_layout_uninit((AVChannelLayout *)ptr); - break; + ((AVChannelLayout *)ptr)->nb_channels = nb_channels; + break;}default:break;
A little bit of context would be helpful here. What's using nb_channels after av_opt_free was called and where?
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
