From 6918e999079d57f4e1d92733e94d5db0cd9638af Mon Sep 17 00:00:00 2001 From: Paul B Mahol Date: Thu, 21 Dec 2023 15:25:02 +0100 Subject: [PATCH] avfilter/f_reverse: fix array overread --- libavfilter/f_reverse.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libavfilter/f_reverse.c b/libavfilter/f_reverse.c index 086819a207..3f5f9d26c7 100644 --- a/libavfilter/f_reverse.c +++ b/libavfilter/f_reverse.c @@ -266,7 +266,9 @@ static int areverse_request_frame(AVFilterLink *outlink) AVFrame *out = s->frames[s->nb_frames - 1]; out->duration = s->duration[s->flush_idx]; out->pts = s->pts[s->flush_idx++] - s->nb_samples; - s->nb_samples += s->pts[s->flush_idx] - s->pts[s->flush_idx - 1] - out->nb_samples; + if (s->nb_frames > 1) + s->nb_samples += s->pts[s->flush_idx]; + s->nb_samples -= s->pts[s->flush_idx - 1] + out->nb_samples; if (av_sample_fmt_is_planar(out->format)) reverse_samples_planar(out);