In block-processing mode config_input() allocated s->mid but, unlike the sibling s->side[] buffers, never checked the result. s->mid is then dereferenced in filter_frame(), so an allocation failure caused a NULL pointer dereference. Return AVERROR(ENOMEM) as is done for s->side[].
Signed-off-by: Anas Khan <[email protected]> --- libavfilter/af_crossfeed.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libavfilter/af_crossfeed.c b/libavfilter/af_crossfeed.c index 6260313fc9..5dcd5dc0c6 100644 --- a/libavfilter/af_crossfeed.c +++ b/libavfilter/af_crossfeed.c @@ -100,6 +100,8 @@ static int config_input(AVFilterLink *inlink) if (s->block_samples == 0 && s->block_size > 0) { s->block_samples = s->block_size; s->mid = av_calloc(s->block_samples * 2, sizeof(*s->mid)); + if (!s->mid) + return AVERROR(ENOMEM); for (int i = 0; i < 3; i++) { s->side[i] = av_calloc(s->block_samples * 2, sizeof(*s->side[0])); if (!s->side[i]) -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
