filter_frame() allocated s->band_buf1..3 with ff_get_audio_buffer() but never checked the results before dereferencing them in the per-channel loop. An allocation failure therefore caused a NULL pointer dereference. Check all three and free the in/out frames before returning AVERROR(ENOMEM).
Signed-off-by: Anas Khan <[email protected]> --- libavfilter/af_mcompand.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavfilter/af_mcompand.c b/libavfilter/af_mcompand.c index 855d893550..70e9b9fa8f 100644 --- a/libavfilter/af_mcompand.c +++ b/libavfilter/af_mcompand.c @@ -573,6 +573,11 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in) s->band_buf2 = ff_get_audio_buffer(outlink, in->nb_samples); s->band_buf3 = ff_get_audio_buffer(outlink, in->nb_samples); s->band_samples = in->nb_samples; + if (!s->band_buf1 || !s->band_buf2 || !s->band_buf3) { + av_frame_free(&in); + av_frame_free(&out); + return AVERROR(ENOMEM); + } } for (ch = 0; ch < outlink->ch_layout.nb_channels; ch++) { -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
