From a25462482c02c004d685a8fcf2fa63955aaa0931 Mon Sep 17 00:00:00 2001
From: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Date: Wed, 6 Aug 2025 16:39:47 +0000
Subject: [PATCH] libavfilter/af_firequalizer: Add check for av_malloc_array()

Add check for the return value of av_malloc_array() to avoid potential NULL pointer dereference.

Fixes: d3be186ed1 ("avfilter/firequalizer: add dumpfile and dumpscale option")
Signed-off-by: Jiasheng Jiang <jiashengjiangcool@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

CVE: CVE-2025-10256
Upstream-Status: Backport [https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
 libavfilter/af_firequalizer.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavfilter/af_firequalizer.c b/libavfilter/af_firequalizer.c
index 38663200eb..f14983b431 100644
--- a/libavfilter/af_firequalizer.c
+++ b/libavfilter/af_firequalizer.c
@@ -793,6 +793,8 @@ static int config_input(AVFilterLink *inlink)
     if (s->dumpfile) {
         s->analysis_rdft = av_rdft_init(rdft_bits, DFT_R2C);
         s->dump_buf = av_malloc_array(s->analysis_rdft_len, sizeof(*s->dump_buf));
+        if (!s->dump_buf)
+            return AVERROR(ENOMEM);
     }
 
     s->analysis_buf = av_malloc_array(s->analysis_rdft_len, sizeof(*s->analysis_buf));
