Author: reimar Date: Fri Nov 11 18:15:13 2011 New Revision: 34342 Log: Sanitize channel count for libaf to avoid crashes since it is used unchecked. af_downmix is an example of a function that can/will crash for invalid values. 0 is not invalid since it is used as "autodetect" for output. Modified: trunk/libaf/af.c Modified: trunk/libaf/af.c ============================================================================== --- trunk/libaf/af.c Thu Nov 10 17:31:07 2011 (r34341) +++ trunk/libaf/af.c Fri Nov 11 18:15:13 2011 (r34342) @@ -664,5 +664,9 @@ void af_help (void) { void af_fix_parameters(af_data_t *data) { + if (data->nch < 0 || data->nch > AF_NCH) { + mp_msg(MSGT_AFILTER, MSGL_ERR, "Invalid number of channels %i, assuming 2.\n", data->nch); + data->nch = 2; + } data->bps = af_fmt2bits(data->format)/8; }