ffmpeg: Check for parameter changes at the output of the audio filter graph

It is currently possible that such changes leak through from the decoder as
well as a filter could generate such changes itself.
This commit blocks such changed packets unless the encoder declares support.

Fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 6 insertions, 0 deletions

diff --git a/ffmpeg.c b/ffmpeg.c
index 6817f9cca7..6c3994f0d4 100644
--- a/ffmpeg.c
+++ b/ffmpeg.c
@@ -1102,6 +1102,12 @@ static int reap_filters(void)
             case AVMEDIA_TYPE_AUDIO:
                 avfilter_copy_buf_props(filtered_frame, picref);
                 filtered_frame->pts = frame_pts;
+                if (!(ost->st->codec->codec->capabilities & CODEC_CAP_PARAM_CHANGE) &&
+                    ost->st->codec->channels != av_frame_get_channels(filtered_frame)) {
+                    av_log(NULL, AV_LOG_ERROR,
+                           "Audio filter graph output is not normalized and encoder does not support parameter changes\n");
+                    break;
+                }
                 do_audio_out(of->ctx, ost, filtered_frame);
                 break;
             default: