Files
ffmpeg/libavfilter
marcos ashton fffa1e3262 avfilter/af_pan: fix sscanf() return value checks in parse_channel_name
sscanf() returns EOF (-1) on input failure, which is non-zero and
passes a bare truthy check. When this happens, the %n directive is
never processed, so len stays uninitialized. Using that value to
advance the arg pointer causes an out-of-bounds read and crash.

Check for >= 1 instead, matching the fix applied to the other
sscanf() call in init() by commit b5b6391d64.

Fixes: https://code.ffmpeg.org/FFmpeg/FFmpeg/issues/22451
Signed-off-by: marcos ashton <marcosashiglesias@gmail.com>
(cherry picked from commit a43ea8bff7)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-05-05 15:21:13 +02:00
..
2025-12-03 20:26:49 +01:00
2022-07-07 17:52:32 +02:00
2025-12-03 20:26:49 +01:00
2022-07-10 17:20:15 +02:00
2025-12-03 20:26:49 +01:00
2025-12-03 20:26:49 +01:00
2022-03-16 14:05:26 +02:00
2022-07-13 00:27:37 +02:00
2022-04-23 10:58:29 +02:00
2024-07-22 10:47:13 +02:00
2025-12-03 20:26:49 +01:00