Commit 8a729ff8ce for ffmpeg
commit 8a729ff8cec82acb50a4f5d2ab43f2f0d94514fd
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon Oct 12 02:16:53 2026 +0200
avfilter/af_sofalizer: check the size of the delay data
Fixes: NULL pointer dereference
Fixes: d80uw1EIP3Pa
Regression since: ee64b64c02
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24624
NULL pointer dereference Replicated through UnModified FFmpeg with ASAN
diff --git a/libavfilter/af_sofalizer.c b/libavfilter/af_sofalizer.c
index 91bc4d0305..fe57777d06 100644
--- a/libavfilter/af_sofalizer.c
+++ b/libavfilter/af_sofalizer.c
@@ -153,7 +153,8 @@ static int preload_sofa(AVFilterContext *ctx, char *filename, int *samplingrate)
return ret;
}
- if (!mysofa->N || !mysofa->M || mysofa->DataIR.elements / mysofa->M / mysofa->R < mysofa->N) {
+ if (!mysofa->N || !mysofa->M || mysofa->DataIR.elements / mysofa->M / mysofa->R < mysofa->N ||
+ (mysofa->DataDelay.elements != mysofa->R && mysofa->DataDelay.elements / mysofa->R < mysofa->M)) {
av_log(ctx, AV_LOG_ERROR, "Selected SOFA file has inconsistent dimensions.\n");
return AVERROR_INVALIDDATA;
}