From 8d6fea70a66c47bfa3a90fba46c494ca94e6d980 Mon Sep 17 00:00:00 2001 From: jlima8900 Date: Tue, 31 Mar 2026 19:17:32 +0100 Subject: [PATCH 1/3] avfilter/signature: fix uninitialized memory and loop bounds issues Fix three issues in the signature filter: - Add bounds check to prevent buffer overflow in pairs array when multiple frames have identical l1 distance - Fix hough space extraction loop to iterate full range (was only checking half of the allocated space, missing positive offsets) - Initialize bestmatch.first/second and pairs[i].a to NULL to prevent potential use of uninitialized pointers Fixes #6354. --- libavfilter/signature_lookup.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libavfilter/signature_lookup.c b/libavfilter/signature_lookup.c index 46602874de..00d597c5e0 100644 --- a/libavfilter/signature_lookup.c +++ b/libavfilter/signature_lookup.c @@ -238,7 +238,7 @@ static MatchingInfo* get_matching_parameters(AVFilterContext *ctx, SignatureCont pairs[i].dist = l1dist; pairs[i].b_pos[0] = j; pairs[i].b[0] = s; - } else if (l1dist == pairs[i].dist) { + } else if (l1dist == pairs[i].dist && pairs[i].size < COARSE_SIZE) { pairs[i].b[pairs[i].size] = s; pairs[i].b_pos[pairs[i].size] = j; pairs[i].size++; @@ -251,6 +251,7 @@ static MatchingInfo* get_matching_parameters(AVFilterContext *ctx, SignatureCont for (; i < COARSE_SIZE; i++) { pairs[i].size = 0; pairs[i].dist = 99999; + pairs[i].a = NULL; } } @@ -295,7 +296,7 @@ static MatchingInfo* get_matching_parameters(AVFilterContext *ctx, SignatureCont if (hmax > 0) { hmax = (int) (0.7*hmax); for (i = 0; i < MAX_FRAMERATE; i++) { - for (j = 0; j < HOUGH_MAX_OFFSET; j++) { + for (j = 0; j < 2 * HOUGH_MAX_OFFSET + 1; j++) { if (hmax < hspace[i][j].score) { c->next = av_malloc(sizeof(MatchingInfo)); c = c->next; @@ -546,6 +547,8 @@ static MatchingInfo lookup_signatures(AVFilterContext *ctx, SignatureContext *sc bestmatch.score = 0; bestmatch.meandist = 99999; bestmatch.whole = 0; + bestmatch.first = NULL; + bestmatch.second = NULL; fill_l1distlut(sc->l1distlut); -- 2.39.5 (Apple Git-154) From 7bd23597001fce82d76870bcc9d7539542cb453b Mon Sep 17 00:00:00 2001 From: jlima8900 Date: Tue, 31 Mar 2026 19:17:38 +0100 Subject: [PATCH 2/3] avfilter/fps: fix single-frame video being dropped When a video has only one frame and the EOF timestamp equals the frame's PTS, the frame would be dropped without ever being output. This is because the drop condition (status_pts <= next_pts) would be true immediately before any output could occur. Fix by adding a check: at the EOF boundary (status_pts == next_pts), only drop if we have received more than one frame OR have already output from the current frame. This ensures single-frame videos output at least once. Fixes #7361. --- libavfilter/vf_fps.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/libavfilter/vf_fps.c b/libavfilter/vf_fps.c index 0257a8ef78..41092bbf52 100644 --- a/libavfilter/vf_fps.c +++ b/libavfilter/vf_fps.c @@ -286,9 +286,11 @@ static int write_frame(AVFilterContext *ctx, FPSContext *s, AVFilterLink *outlin * - If we have two buffered frames and the second frame is acceptable * as the next output frame, then drop the first buffered frame. * - If we have status (EOF) set, drop frames when we hit the - * status timestamp. */ + * status timestamp, but ensure we output at least once if we have + * a single-frame input that hasn't been output yet. */ if ((s->frames_count == 2 && s->frames[1]->pts <= s->next_pts) || - (s->status && s->status_pts <= s->next_pts)) { + (s->status && s->status_pts <= s->next_pts && + (s->status_pts < s->next_pts || s->frames_in > 1 || s->cur_frame_out > 0))) { frame = shift_frame(ctx, s); av_frame_free(&frame); -- 2.39.5 (Apple Git-154) From 85029170ed0e04ce8292cd3e074d2d81d322ce8c Mon Sep 17 00:00:00 2001 From: jlima8900 Date: Tue, 31 Mar 2026 19:17:43 +0100 Subject: [PATCH 3/3] avfilter/showwaves: add channel validation and fix integer overflow Add validation to reject input with invalid number of channels (<=0) which could cause heap buffer overflow when allocating buf_idy array. Also cast multiplication to int64_t to prevent integer overflow when calculating history_nb_samples for large width/channel combinations. Fixes #10756. --- libavfilter/avf_showwaves.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/libavfilter/avf_showwaves.c b/libavfilter/avf_showwaves.c index dda15c5306..8f249cf9ae 100644 --- a/libavfilter/avf_showwaves.c +++ b/libavfilter/avf_showwaves.c @@ -411,6 +411,11 @@ static int config_output(AVFilterLink *outlink) showwaves->q = av_make_q(0, 1); showwaves->c = av_make_q(0, 1); + if (nb_channels <= 0) { + av_log(ctx, AV_LOG_ERROR, "Invalid number of channels: %d\n", nb_channels); + return AVERROR(EINVAL); + } + if (showwaves->single_pic) { showwaves->n = av_make_q(1, 1); l->frame_rate = av_make_q(1, 1); @@ -430,7 +435,7 @@ static int config_output(AVFilterLink *outlink) return AVERROR(ENOMEM); } - showwaves->history_nb_samples = av_rescale(showwaves->w * nb_channels * 2, + showwaves->history_nb_samples = av_rescale((int64_t)showwaves->w * nb_channels * 2, showwaves->n.num, showwaves->n.den); if (showwaves->history_nb_samples <= 0) return AVERROR(EINVAL); -- 2.39.5 (Apple Git-154)