No description
Find a file
Andreas Rheinhardt 4147f63d63 avfilter/formats: Fix heap-buffer overflow when merging channel layouts
The channel layouts accepted by ff_merge_channel_layouts() are of two
types: Ordinary channel layouts and generic channel layouts. These are
layouts that match all layouts with a certain number of channels.
Therefore parsing these channel layouts is not done in one go; instead
first the intersection of the ordinary layouts of the first input
list of channel layouts with the ordinary layouts of the second list is
determined, then the intersection of the ordinary layouts of the first
one and the generic layouts of the second one etc. In order to mark the
ordinary channel layouts that have already been matched as used they are
zeroed. The inner loop that does this is as follows:

for (j = 0; j < b->nb_channel_layouts; j++) {
    if (a->channel_layouts[i] == b->channel_layouts[j]) {
        ret->channel_layouts[ret_nb++] = a->channel_layouts[i];
        a->channel_layouts[i] = b->channel_layouts[j] = 0;
    }
}

(Here ret->channel_layouts is the array containing the intersection of
the two input arrays.)

Yet the problem with this code is that after a match has been found, the
loop continues the search with the new value a->channel_layouts[i].
The intention of zeroing these elements was to make sure that elements
already paired at this stage are ignored later. And while they are indeed
ignored when pairing ordinary and generic channel layouts later, it has
the exact opposite effect when pairing ordinary channel layouts.

To see this consider the channel layouts A B C D E and E D C B A. In the
first round, A and A will be paired and added to ret->channel_layouts.
In the second round, the input arrays are 0 B C D E and E D C B 0.
At first B and B will be matched and zeroed, but after doing so matching
continues, but this time it will search for 0, which will match with the
last entry of the second array. ret->channel_layouts now contains A B 0.
In the third round, C 0 0 will be added to ret->channel_layouts etc.
This gives a quadratic amount of elements, yet the amount of elements
allocated for said array is only the sum of the sizes of a and b.

This issue can e.g. be reproduced by
ffmpeg -f lavfi -i anullsrc=cl=7.1 \
-af 'aformat=cl=mono|stereo|2.1|3.0|4.0,aformat=cl=4.0|3.0|2.1|stereo|mono' \
-f null -

The fix is easy: break out of the inner loop after having found a match.

Reviewed-by: Nicolas George <george@nsup.org>
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
2020-08-13 16:28:26 +02:00
compat compat/cuda/ptx2c: remove shell loop; fix BSD sed compat 2020-06-01 22:10:41 -05:00
doc doc/general: mark that CFHD have encoder now 2020-08-11 12:34:41 +02:00
ffbuild ffbuild: Refine MIPS handling 2020-07-23 16:30:02 +02:00
fftools fftools/ffmpeg: make specifying thread_queue_size turn on threaded input 2020-07-29 23:10:12 +02:00
libavcodec cbs: Mention all codecs in unit type comment 2020-08-12 22:02:03 +01:00
libavdevice kmsgrab: Add more supported formats 2020-08-09 20:18:49 +01:00
libavfilter avfilter/formats: Fix heap-buffer overflow when merging channel layouts 2020-08-13 16:28:26 +02:00
libavformat lavf/url: rewrite ff_make_absolute_url() using ff_url_decompose(). 2020-08-12 16:45:21 +02:00
libavresample avresample: remove deprecated attribute from the AVAudioResampleContext struct 2018-01-09 10:56:53 -03:00
libavutil avutil/channel_layout: add 22.2 layout 2020-08-04 00:17:56 +03:00
libpostproc Bump minor versions after branching 4.3 2020-06-08 22:49:04 +02:00
libswresample swresample/rematrix: treat 22.2 as 5.1 (back) when mixing 2020-08-04 00:17:56 +03:00
libswscale swscale: do not drop half of bits from 16bit bayer formats 2020-08-08 12:03:42 +02:00
presets
tests lavc/aac_ac3_parser: fix potential overflow when averaging bitrate 2020-08-12 17:35:38 +02:00
tools dnn_backend_native_layer_mathunary: add round support 2020-08-12 10:30:46 +08:00
.gitattributes fate: add SCC test 2017-01-27 17:06:42 +01:00
.gitignore tools/python: add script to convert TensorFlow model (.pb) to native model (.model) 2019-07-01 10:23:47 -03:00
.mailmap mailmap: add entry for myself 2020-07-13 11:24:04 +08:00
.travis.yml Merge commit '899ee03088' 2019-03-14 15:53:16 -03:00
Changelog avformat: add argo_asf muxer 2020-08-07 23:14:28 +10:00
configure kmsgrab: Use GetFB2 if available 2020-08-09 20:18:48 +01:00
CONTRIBUTING.md Add CONTRIBUTING.md 2016-09-18 10:02:13 +01:00
COPYING.GPLv2
COPYING.GPLv3
COPYING.LGPLv2.1
COPYING.LGPLv3
CREDITS
INSTALL.md INSTALL.md: Fix Markdown formatting 2019-01-31 10:29:16 -09:00
LICENSE.md avfilter/vf_geq: Relicense to LGPL 2019-12-28 11:20:48 +01:00
MAINTAINERS MAINTAINERS: add myself and gpg fingerprint 2020-07-17 21:57:18 +02:00
Makefile Makefile: Delete more created files when running "make distclean". 2020-03-11 11:43:01 +01:00
README.md Remove the ffserver program 2018-01-06 18:31:37 +00:00
RELEASE RELEASE: We are after the 4.3 branch point, update for that 2020-06-10 00:20:24 +02:00

FFmpeg README

FFmpeg is a collection of libraries and tools to process multimedia content such as audio, video, subtitles and related metadata.

Libraries

  • libavcodec provides implementation of a wider range of codecs.
  • libavformat implements streaming protocols, container formats and basic I/O access.
  • libavutil includes hashers, decompressors and miscellaneous utility functions.
  • libavfilter provides a mean to alter decoded Audio and Video through chain of filters.
  • libavdevice provides an abstraction to access capture and playback devices.
  • libswresample implements audio mixing and resampling routines.
  • libswscale implements color conversion and scaling routines.

Tools

  • ffmpeg is a command line toolbox to manipulate, convert and stream multimedia content.
  • ffplay is a minimalistic multimedia player.
  • ffprobe is a simple analysis tool to inspect multimedia content.
  • Additional small tools such as aviocat, ismindex and qt-faststart.

Documentation

The offline documentation is available in the doc/ directory.

The online documentation is available in the main website and in the wiki.

Examples

Coding examples are available in the doc/examples directory.

License

FFmpeg codebase is mainly LGPL-licensed with optional components licensed under GPL. Please refer to the LICENSE file for detailed information.

Contributing

Patches should be submitted to the ffmpeg-devel mailing list using git format-patch or git send-email. Github pull requests should be avoided because they are not part of our review process and will be ignored.