The sidechaingate filter wants its main input and its (only) output to have the same channel layout and number of channels; yet it does not link them in its query_formats callback. Instead it sets the outlink to only accept the first offered choice for the main input's channel layout and then sets both inputs to independently accept any channel counts. The config_output callback then overwrote the outlink's channel layout and channels properties with the main input's, even though they may differ in case the first offered choice for the main input's channel layout turns out not to be the final one. Consider e.g. the following filtergraph: [in]aformat=channel_layouts=mono,aformat=channel_layouts=stereo|mono[out];\ [out][in2]sidechaingate,stereotools The two aformats ensure that the first offered channel layout (stereo) will not be chosen for the input; yet it is the only offered channel layout for the output of sidechaingate and will therefore be chosen by the query_formats framework. Because the sidechaingate outputs interleaved doubles which stereotools expects the output of sidechaingate appears to be suitable as input for stereotools without further conversions. Yet stereotools actually only receives a mono frame and therefore overreads its input buffer which leads to segfaults; it can also lead to heap corruption because there can be writes beyond the end of the buffer, too. Fix this by linking the channel layouts of the main input and the output in query_formats and remove the code overwriting it in config_output.
Showing the changes to libavfilter (1 of 1 file). Show all
Unified · Split
| @@ -332,29 +332,19 @@ static int activate(AVFilterContext *ctx) · 331 unmodified lines | |||
| 332 | 332 | ||
| 333 | static int scquery_formats(AVFilterContext *ctx) | 333 | static int scquery_formats(AVFilterContext *ctx) |
| 334 | { | 334 | { |
| 335 | AVFilterChannelLayouts *layouts = NULL; | ||
| 336 | static const enum AVSampleFormat sample_fmts[] = { | 335 | static const enum AVSampleFormat sample_fmts[] = { |
| 337 | AV_SAMPLE_FMT_DBL, | 336 | AV_SAMPLE_FMT_DBL, |
| 338 | AV_SAMPLE_FMT_NONE | 337 | AV_SAMPLE_FMT_NONE |
| 339 | }; | 338 | }; |
| 340 | int ret, i; | 339 | int ret = ff_channel_layouts_ref(ff_all_channel_counts(), |
| 341 | 340 | &ctx->inputs[1]->outcfg.channel_layouts); | |
| 342 | if (!ctx->inputs[0]->incfg.channel_layouts || | 341 | if (ret < 0) |
| 343 | !ctx->inputs[0]->incfg.channel_layouts->nb_channel_layouts) { | ||
| 344 | av_log(ctx, AV_LOG_WARNING, | ||
| 345 | "No channel layout for input 1\n"); | ||
| 346 | return AVERROR(EAGAIN); | ||
| 347 | } | ||
| 348 | |||
| 349 | if ((ret = ff_add_channel_layout(&layouts, ctx->inputs[0]->incfg.channel_layouts->channel_layouts[0])) < 0 || | ||
| 350 | (ret = ff_channel_layouts_ref(layouts, &ctx->outputs[0]->incfg.channel_layouts)) < 0) | ||
| 351 | return ret; | 342 | return ret; |
| 352 | 343 | ||
| 353 | for (i = 0; i < 2; i++) { | 344 | /* This will link the channel properties of the main input and the output; |
| 354 | layouts = ff_all_channel_counts(); | 345 | * it won't touch the second input as its channel_layouts is already set. */ |
| 355 | if ((ret = ff_channel_layouts_ref(layouts, &ctx->inputs[i]->outcfg.channel_layouts)) < 0) | 346 | if ((ret = ff_set_common_all_channel_counts(ctx)) < 0) |
| 356 | return ret; | 347 | return ret; |
| 357 | } | ||
| 358 | 348 | ||
| 359 | if ((ret = ff_set_common_formats_from_list(ctx, sample_fmts)) < 0) | 349 | if ((ret = ff_set_common_formats_from_list(ctx, sample_fmts)) < 0) |
| 360 | return ret; | 350 | return ret; |
| @@ -377,8 +367,6 @@ static int scconfig_output(AVFilterLink *outlink) · 16 unmodified lines | |||
| 377 | 367 | ||
| 378 | outlink->sample_rate = ctx->inputs[0]->sample_rate; | 368 | outlink->sample_rate = ctx->inputs[0]->sample_rate; |
| 379 | outlink->time_base = ctx->inputs[0]->time_base; | 369 | outlink->time_base = ctx->inputs[0]->time_base; |
| 380 | outlink->channel_layout = ctx->inputs[0]->channel_layout; | ||
| 381 | outlink->channels = ctx->inputs[0]->channels; | ||
| 382 | 370 | ||
| 383 | s->fifo[0] = av_audio_fifo_alloc(ctx->inputs[0]->format, ctx->inputs[0]->channels, 1024); | 371 | s->fifo[0] = av_audio_fifo_alloc(ctx->inputs[0]->format, ctx->inputs[0]->channels, 1024); |
| 384 | s->fifo[1] = av_audio_fifo_alloc(ctx->inputs[1]->format, ctx->inputs[1]->channels, 1024); | 372 | s->fifo[1] = av_audio_fifo_alloc(ctx->inputs[1]->format, ctx->inputs[1]->channels, 1024); |