Repository navigation
Bound AudioFrame.planes by the number of planes - #2502
Merged
Merged
Conversation
extended_data is not NULL-terminated. With 8 planar channels it points at the frame's data[8] array, so the loop read linesize[0] as a ninth plane pointer and AudioPlane raised "plane index 8 out of range for 8 planes": .planes, to_ndarray() and from_ndarray() failed for 7.1 planar audio. With more than 8 channels the loop read past the end of the heap array. Stop at the number of planes, as VideoFrame.planes already does.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AudioFrame.planescounted planes by walkingextended_datauntil it hit a NULL pointer, butextended_datais not NULL-terminated.For planar audio with 8 channels (e.g.
fltp/7.1), FFmpeg pointsextended_dataat the frame's owndata[8]array, which is followed bylinesize[8]. The loop therefore readlinesize[0]as a ninth plane pointer, counted 9 planes, andAudioPlaneraisedplane index 8 out of range for 8 planes. So.planes,to_ndarray()andfrom_ndarray()all fail for 7.1 planar audio. With more than 8 channels the loop read past the end of the heap-allocatedextended_dataarray.The loop now stops at the number of planes (
nb_channelsfor planar formats, 1 for packed), the same wayVideoFrame.planesalready caps its count. The NULL check stays, so a frame without buffers still has no planes.Added
test_manual_fltp_7_1_constructor. I ran the smoke workflow on my fork with the test alone and with the fix:master): fails on all 6 test jobs (Ubuntu, macOS, Windows; FFmpeg 8.1.3 and 9.0.2), e.g.make lintpasses: https://github.com/ChandraChaan/PyAV/actions/runs/41396712981The RISC-V job never got a runner on my fork, so it didn't run.