From 084ef7d7d542e238e56afd2ee8e64fe46d37104e Mon Sep 17 00:00:00 2001
From: Marton Balint <cus@passwd.hu>
Date: Sat, 24 Mar 2018 22:57:34 +0100
Subject: [PATCH] avfilter/af_pan: reject expressions referencing the same
 channel multiple times

Fixes parsing of expressions like c0=c0+c0 or c0=c0|c0=c1.  Previously no
error was thrown and for input channels, only the last gain factor was used,
for output channels the source channel gains were combined.

Signed-off-by: Marton Balint <cus@passwd.hu>
---
 libavfilter/af_pan.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/libavfilter/af_pan.c b/libavfilter/af_pan.c
index d8a63a7952..34e522c9d4 100644
--- a/libavfilter/af_pan.c
+++ b/libavfilter/af_pan.c
@@ -104,6 +104,7 @@ static av_cold int init(AVFilterContext *ctx)
     char *arg, *arg0, *tokenizer, *args = av_strdup(pan->args);
     int out_ch_id, in_ch_id, len, named, ret, sign = 1;
     int nb_in_channels[2] = { 0, 0 }; // number of unnamed and named input channels
+    int used_out_ch[MAX_CHANNELS] = {0};
     double gain;
 
     if (!pan->args) {
@@ -127,6 +128,7 @@ static av_cold int init(AVFilterContext *ctx)
 
     /* parse channel specifications */
     while ((arg = arg0 = av_strtok(NULL, "|", &tokenizer))) {
+        int used_in_ch[MAX_CHANNELS] = {0};
         /* channel name */
         if (parse_channel_name(&arg, &out_ch_id, &named)) {
             av_log(ctx, AV_LOG_ERROR,
@@ -153,6 +155,13 @@ static av_cold int init(AVFilterContext *ctx)
             ret = AVERROR(EINVAL);
             goto fail;
         }
+        if (used_out_ch[out_ch_id]) {
+            av_log(ctx, AV_LOG_ERROR,
+                   "Can not reference out channel %d twice\n", out_ch_id);
+            ret = AVERROR(EINVAL);
+            goto fail;
+        }
+        used_out_ch[out_ch_id] = 1;
         skip_spaces(&arg);
         if (*arg == '=') {
             arg++;
@@ -184,6 +193,13 @@ static av_cold int init(AVFilterContext *ctx)
                 ret = AVERROR(EINVAL);
                 goto fail;
             }
+            if (used_in_ch[in_ch_id]) {
+                av_log(ctx, AV_LOG_ERROR,
+                       "Can not reference in channel %d twice\n", in_ch_id);
+                ret = AVERROR(EINVAL);
+                goto fail;
+            }
+            used_in_ch[in_ch_id] = 1;
             pan->gain[out_ch_id][in_ch_id] = sign * gain;
             skip_spaces(&arg);
             if (!*arg)