Files
ffmpeg/libavfilter
Franciszek Kalinowski 64fd93e361 avfilter/af_join: fix wrong loop bound in buffer dedup (use-after-free)
try_push_frame() decides whether an input buffer is already tracked by testing
`j == i` (the channel index) instead of `j == nb_buffers`. Once an earlier
channel shared a buffer, nb_buffers falls behind i and a genuinely new buffer is
never referenced, so it is freed while the output frame still points at it.

Reported by Franciszek Kalinowski (isec.pl / striga.ai) and Bartosz Smigielski.

(cherry picked from commit 461fb22053)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-06-14 04:40:55 +02:00
..
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2025-12-14 12:41:00 +05:30
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2026-05-04 00:07:35 +02:00
2025-06-15 21:00:38 +05:30
2025-10-16 18:41:19 +02:00
2025-07-04 01:32:27 +02:00
2025-07-04 01:32:27 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2025-08-03 13:48:47 +02:00
2025-04-22 20:45:57 +02:00