Franciszek Kalinowski
461fb22053
avfilter/af_join: fix wrong loop bound in buffer dedup (use-after-free)
...
try_push_frame() decides whether an input buffer is already tracked by testing
`j == i` (the channel index) instead of `j == nb_buffers`. Once an earlier
channel shared a buffer, nb_buffers falls behind i and a genuinely new buffer is
never referenced, so it is freed while the output frame still points at it.
Reported by Franciszek Kalinowski (isec.pl / striga.ai) and Bartosz Smigielski.
2026-05-25 22:21:41 +00:00
..
2026-04-04 11:31:16 +00:00
2026-03-21 16:25:40 +08:00
2026-05-22 14:06:03 +09:00
2026-05-15 20:29:29 +02:00
2026-03-10 13:52:19 +01:00
2026-03-10 13:52:19 +01:00
2026-04-28 12:29:37 +00:00
2026-05-25 22:21:41 +00:00
2026-02-26 11:40:16 +08:00
2026-03-13 21:31:54 +01:00
2026-03-21 00:44:30 +00:00
2026-04-08 11:52:44 -03:00
2026-04-21 16:47:05 +00:00
2026-04-10 15:12:18 +02:00
2026-04-28 12:29:37 +00:00
2026-03-10 13:52:19 +01:00
2026-04-10 15:12:18 +02:00
2026-05-13 20:11:19 +08:00
2026-05-16 17:22:45 +00:00
2026-02-28 12:13:02 +00:00
2026-04-12 20:02:18 +00:00
2026-03-29 09:38:01 +00:00
2026-03-06 03:21:37 +01:00
2026-04-28 12:29:37 +00:00
2026-04-10 22:02:00 +02:00
2026-04-10 15:12:18 +02:00
2026-04-21 16:47:05 +00:00
2026-04-28 06:14:38 +00:00
2026-05-15 18:19:40 -07:00
2026-04-21 16:47:05 +00:00
2026-04-28 14:57:34 +00:00
2026-03-13 12:52:57 -03:00
2026-04-21 08:28:45 +02:00
2026-05-22 14:06:03 +09:00
2026-04-22 12:45:45 +02:00
2026-02-26 11:40:16 +08:00
2026-03-10 13:52:19 +01:00
2026-04-21 08:28:45 +02:00
2026-03-14 23:26:51 +08:00
2026-04-21 08:28:50 +02:00
2026-03-10 13:52:19 +01:00
2026-05-03 13:23:21 +00:00
2026-04-28 12:29:37 +00:00
2026-04-28 12:29:37 +00:00
2026-03-06 03:21:37 +01:00
2026-03-06 01:45:09 -05:00
2026-02-26 11:40:16 +08:00
2026-04-22 12:33:26 +00:00
2026-04-28 12:29:37 +00:00
2026-04-21 08:28:50 +02:00
2026-02-26 11:40:16 +08:00
2026-04-21 16:47:05 +00:00
2026-04-30 08:33:31 -05:00
2026-04-21 08:28:50 +02:00
2026-03-09 19:07:34 +01:00
2026-04-21 08:28:49 +02:00
2026-05-03 13:25:48 +00:00
2026-03-27 21:00:53 -03:00
2026-04-28 06:14:38 +00:00
2026-04-28 12:29:37 +00:00
2026-02-26 11:40:16 +08:00
2026-04-26 16:05:11 +08:00
2026-04-28 12:29:37 +00:00
2026-05-22 14:06:01 +09:00
2026-04-22 12:45:45 +02:00
2026-05-15 20:29:29 +02:00
2026-05-15 20:29:29 +02:00
2026-04-28 06:14:38 +00:00
2026-04-04 11:31:16 +00:00
2026-04-28 06:14:38 +00:00
2026-04-28 06:14:38 +00:00
2026-04-28 06:14:38 +00:00
2026-04-28 06:14:38 +00:00
2026-04-28 06:14:38 +00:00
2026-05-02 14:47:00 +02:00
2026-04-22 12:45:40 +02:00
2026-03-11 10:23:35 +01:00
2026-04-13 19:49:32 +08:00
2026-05-03 18:22:51 +02:00
2026-05-03 18:22:49 +02:00
2026-03-27 19:42:08 -03:00
2026-02-26 11:40:16 +08:00
2026-02-26 11:40:16 +08:00
2026-04-20 21:08:21 +02:00
2026-04-20 21:08:21 +02:00
2026-04-21 08:28:50 +02:00
2026-04-30 21:15:58 +00:00
2026-04-21 08:28:45 +02:00
2026-04-28 12:29:37 +00:00
2026-04-01 21:56:37 +08:00
2026-03-31 11:17:51 +00:00
2026-04-21 09:39:54 +02:00
2026-04-10 15:12:18 +02:00
2026-02-26 11:40:16 +08:00
2026-04-21 08:28:50 +02:00
2026-04-28 12:29:37 +00:00
2026-04-21 08:28:45 +02:00
2026-04-21 08:28:45 +02:00