Files
ffmpeg/libavfilter
Franciszek Kalinowski 461fb22053 avfilter/af_join: fix wrong loop bound in buffer dedup (use-after-free)
try_push_frame() decides whether an input buffer is already tracked by testing
`j == i` (the channel index) instead of `j == nb_buffers`. Once an earlier
channel shared a buffer, nb_buffers falls behind i and a genuinely new buffer is
never referenced, so it is freed while the output frame still points at it.

Reported by Franciszek Kalinowski (isec.pl / striga.ai) and Bartosz Smigielski.
2026-05-25 22:21:41 +00:00
..
2026-05-15 20:29:29 +02:00
2026-05-15 20:29:29 +02:00
2026-04-28 12:29:37 +00:00