avfilter_get_video_buffer_ref_from_frame: check channel count
authorMichael Niedermayer <michaelni@gmx.at>
Wed, 12 Dec 2012 13:09:19 +0000 (14:09 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Wed, 12 Dec 2012 13:12:47 +0000 (14:12 +0100)
more than 8 channels is not supported and crashes with null pointer dereference

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavfilter/avcodec.c

index 688f1b3..705cf80 100644 (file)
@@ -92,8 +92,12 @@ AVFilterBufferRef *avfilter_get_video_buffer_ref_from_frame(const AVFrame *frame
 AVFilterBufferRef *avfilter_get_audio_buffer_ref_from_frame(const AVFrame *frame,
                                                             int perms)
 {
-    AVFilterBufferRef *samplesref =
-        avfilter_get_audio_buffer_ref_from_arrays((uint8_t **)frame->data, frame->linesize[0], perms,
+    AVFilterBufferRef *samplesref;
+
+    if(av_frame_get_channels(frame) > 8) // libavfilter does not suport more than 8 channels FIXME, remove once libavfilter is fixed
+        return NULL;
+
+    samplesref = avfilter_get_audio_buffer_ref_from_arrays((uint8_t **)frame->data, frame->linesize[0], perms,
                                                   frame->nb_samples, frame->format,
                                                   av_frame_get_channel_layout(frame));
     if (!samplesref)