• Andreas Rheinhardt's avatar
    avfilter/avfiltergraph: Fix use-after-free when inserting auto-converter · 5e1dac38
    Andreas Rheinhardt authored
    When inserting an auto-resampler, it may be that the configuration
    of the filters that the auto-resampler is supposed to connect is
    already partially merged, i.e. converter->inputs[0].incfg.foo and
    converter->outputs[0].outcfg.foo (where foo is one of formats,
    samplerates, channel_layouts) can coincide. Therefore merging
    the converter filter's input link might modify the outcfg of the
    converter' outlink. Yet the current code in avfiltergraph.c used
    pointers from before merging the inlink for merging the outlink,
    leading to a use-after-free in command lines like:
    $ ffmpeg -f lavfi -i anullsrc=cl=stereo -lavfi channelsplit,axcorrelate -f null -
    Fix this by not using outdated values when merging the outlink.
    
    This is a regression since 85a6404d.
    Found-by: 's avatarPaul B Mahol <onemda@gmail.com>
    Reviewed-by: 's avatarPaul B Mahol <onemda@gmail.com>
    Signed-off-by: 's avatarAndreas Rheinhardt <andreas.rheinhardt@outlook.com>
    5e1dac38
avfiltergraph.c 47 KB