Franciszek Kalinowski
461fb22053
avfilter/af_join: fix wrong loop bound in buffer dedup (use-after-free)
...
try_push_frame() decides whether an input buffer is already tracked by testing
`j == i` (the channel index) instead of `j == nb_buffers`. Once an earlier
channel shared a buffer, nb_buffers falls behind i and a genuinely new buffer is
never referenced, so it is freed while the output frame still points at it.
Reported by Franciszek Kalinowski (isec.pl / striga.ai) and Bartosz Smigielski.
2026-05-25 22:21:41 +00:00
..
2026-05-22 14:06:03 +09:00
2026-05-15 20:29:29 +02:00
2026-04-28 12:29:37 +00:00
2026-05-25 22:21:41 +00:00
2026-04-08 11:52:44 -03:00
2026-04-21 16:47:05 +00:00
2026-04-10 15:12:18 +02:00
2026-04-28 12:29:37 +00:00
2026-04-10 15:12:18 +02:00
2026-05-13 20:11:19 +08:00
2026-05-16 17:22:45 +00:00
2026-04-12 20:02:18 +00:00
2026-04-28 12:29:37 +00:00
2026-04-10 22:02:00 +02:00
2026-04-10 15:12:18 +02:00
2026-04-21 16:47:05 +00:00
2026-04-28 06:14:38 +00:00
2026-05-15 18:19:40 -07:00
2026-04-21 16:47:05 +00:00
2026-04-28 14:57:34 +00:00
2026-04-21 08:28:45 +02:00
2026-05-22 14:06:03 +09:00
2026-04-22 12:45:45 +02:00
2026-04-21 08:28:45 +02:00
2026-04-21 08:28:50 +02:00
2026-05-03 13:23:21 +00:00
2026-04-28 12:29:37 +00:00
2026-04-28 12:29:37 +00:00
2026-04-22 12:33:26 +00:00
2026-04-28 12:29:37 +00:00
2026-04-21 08:28:50 +02:00
2026-04-21 16:47:05 +00:00
2026-04-30 08:33:31 -05:00
2026-04-21 08:28:50 +02:00
2026-04-21 08:28:49 +02:00
2026-05-03 13:25:48 +00:00
2026-04-28 06:14:38 +00:00
2026-04-28 12:29:37 +00:00
2026-04-26 16:05:11 +08:00
2026-04-28 12:29:37 +00:00
2026-05-22 14:06:01 +09:00
2026-04-22 12:45:45 +02:00
2026-05-15 20:29:29 +02:00
2026-05-15 20:29:29 +02:00
2026-04-28 06:14:38 +00:00
2026-04-28 06:14:38 +00:00
2026-04-28 06:14:38 +00:00
2026-04-28 06:14:38 +00:00
2026-04-28 06:14:38 +00:00
2026-04-28 06:14:38 +00:00
2026-05-02 14:47:00 +02:00
2026-04-22 12:45:40 +02:00
2026-04-13 19:49:32 +08:00
2026-05-03 18:22:51 +02:00
2026-05-03 18:22:49 +02:00
2026-04-20 21:08:21 +02:00
2026-04-20 21:08:21 +02:00
2026-04-21 08:28:50 +02:00
2026-04-30 21:15:58 +00:00
2026-04-21 08:28:45 +02:00
2026-04-28 12:29:37 +00:00
2026-04-21 09:39:54 +02:00
2026-04-10 15:12:18 +02:00
2026-04-21 08:28:50 +02:00
2026-04-28 12:29:37 +00:00
2026-04-21 08:28:45 +02:00
2026-04-21 08:28:45 +02:00