From 4d896a22dd440dc886fd4c0d89992a55e886390b Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 12 Aug 2026 02:24:41 +0200 Subject: [PATCH] avfilter/spectrumsynth: negotiate one pixel format for both inputs Fixes: out of array access Fixes: ndSS0e433gq Found-by: Eunsoo Kim, Microsoft FORGE Labs --- libavfilter/vaf_spectrumsynth.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/libavfilter/vaf_spectrumsynth.c b/libavfilter/vaf_spectrumsynth.c index 8873062e23..0a750fbda0 100644 --- a/libavfilter/vaf_spectrumsynth.c +++ b/libavfilter/vaf_spectrumsynth.c @@ -127,13 +127,8 @@ static int query_formats(const AVFilterContext *ctx, formats = ff_make_pixel_format_list(pix_fmts); if (!formats) return AVERROR(ENOMEM); - if ((ret = ff_formats_ref(formats, &cfg_in[MAGNITUDE]->formats)) < 0) - return ret; - - formats = ff_make_pixel_format_list(pix_fmts); - if (!formats) - return AVERROR(ENOMEM); - if ((ret = ff_formats_ref(formats, &cfg_in[PHASE]->formats)) < 0) + if ((ret = ff_formats_ref(formats, &cfg_in[MAGNITUDE]->formats)) < 0 || + (ret = ff_formats_ref(formats, &cfg_in[PHASE]->formats)) < 0) return ret; return 0;