avfilter/af_pan: check nb_output_channels before use

Fixes: CID1500281 Out-of-bounds write
Fixes: CID1500331 Out-of-bounds write

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2024-06-10 23:41:07 +02:00
parent 2d0d502ff1
commit 5fe8bf4aa5
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64

View File

@ -119,6 +119,14 @@ static av_cold int init(AVFilterContext *ctx)
if (ret < 0)
goto fail;
if (pan->nb_output_channels > MAX_CHANNELS) {
av_log(ctx, AV_LOG_ERROR,
"af_pan supports a maximum of %d channels. "
"Feel free to ask for a higher limit.\n", MAX_CHANNELS);
ret = AVERROR_PATCHWELCOME;
goto fail;
}
/* parse channel specifications */
while ((arg = arg0 = av_strtok(NULL, "|", &tokenizer))) {
int used_in_ch[MAX_CHANNELS] = {0};