Commit 7b95d353fa for ffmpeg
commit 7b95d353fa1c548ec65c9fd3e3908cc6c5a4e403
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed Oct 7 00:05:29 2026 +0200
avformat/wavenc: Keep the peak envelope channel index across packets
The channel index restarted at 0 for every packet, so after a packet
that ended inside a sample frame the following samples were counted
for the wrong channels.
Wrong peak values Replicated through UnModified FFmpeg
Found during triage of the security report LHiad3FmdAmI
diff --git a/libavformat/wavenc.c b/libavformat/wavenc.c
index 9de3f7b789..9566850503 100644
--- a/libavformat/wavenc.c
+++ b/libavformat/wavenc.c
@@ -86,6 +86,7 @@ typedef struct WAVMuxContext {
int peak_block_size;
int peak_format;
int peak_block_pos;
+ int peak_channel;
int peak_ppv;
int peak_bps;
} WAVMuxContext;
@@ -404,7 +405,7 @@ static int wav_write_packet(AVFormatContext *s, AVPacket *pkt)
avio_write(pb, pkt->data, pkt->size);
if (wav->write_peak) {
- int c = 0;
+ int c = wav->peak_channel;
int i;
for (i = 0; i < pkt->size; i += wav->peak_bps) {
if (wav->peak_bps == 1) {
@@ -424,6 +425,7 @@ static int wav_write_packet(AVFormatContext *s, AVPacket *pkt)
}
}
}
+ wav->peak_channel = c;
}
if(pkt->pts != AV_NOPTS_VALUE) {