[FFmpeg-devel] [PATCH] avcodec/libmp3lame: check channel count after the lame_init_params()

[James Almer]

LAME will silently change the channel count value if you pass it an unsupported
one.
This should normally not be an issue as we ensure only 1 and 2 channel streams
are ever initialized, but since LAME could make changes outside our control
anytime, add an extra check for this.

Signed-off-by: James Almer <jamrial at gmail.com>
---
A crash can be triggered if you remove the AVCodec.channel_layouts array, in
which case non-mono and non-stereo streams will be initialized, but LAME will
try to encode them as if they were stereo.

I decided to not make this an assert() since, like i said above and even if
unlikely to happen, LAME could make changes and suddenly the list of valid
layouts we defined is no longer correct.

 libavcodec/libmp3lame.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/libavcodec/libmp3lame.c b/libavcodec/libmp3lame.c
index 5675864bb2..93d2ef348a 100644
--- a/libavcodec/libmp3lame.c
+++ b/libavcodec/libmp3lame.c
@@ -142,6 +142,15 @@ static av_cold int mp3lame_encode_init(AVCodecContext *avctx)
         goto error;
     }
 
+    /* LAME does not error out on unsupported channel values and silently
+     * changes it to a supported one. Look for this and abort.
+     */
+    if (lame_get_num_channels(s->gfp) != avctx->channels) {
+        av_log(avctx, AV_LOG_ERROR, "Incosistent channel count\n");
+        ret = AVERROR_EXTERNAL;
+        goto error;
+    }
+
     /* get encoder delay */
     avctx->initial_padding = lame_get_encoder_delay(s->gfp) + 528 + 1;
     ff_af_queue_init(avctx, &s->afq);
-- 
2.34.1