From b1942734c7cbcdc9034034373abcc9ecb9644c47 Mon Sep 17 00:00:00 2001
From: Paul B Mahol <onemda@gmail.com>
Date: Mon, 27 Nov 2023 11:45:34 +0100
Subject: [PATCH 2/4] avfilter/af_afwtdn: fix crash with EOF handling

CVE: CVE-2023-50007

Upstream-Status: Backport [https://github.com/FFmpeg/FFmpeg/commit/b1942734c7cbcdc9034034373abcc9ecb9644c47]

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
---
 libavfilter/af_afwtdn.c | 34 +++++++++++++++++++---------------
 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/libavfilter/af_afwtdn.c b/libavfilter/af_afwtdn.c
index 09b504d..1839190 100644
--- a/libavfilter/af_afwtdn.c
+++ b/libavfilter/af_afwtdn.c
@@ -410,6 +410,7 @@ typedef struct AudioFWTDNContext {

     uint64_t sn;
     int64_t eof_pts;
+    int eof;

     int wavelet_type;
     int channels;
@@ -1071,7 +1072,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
         s->drop_samples = 0;
     } else {
         if (s->padd_samples < 0 && eof) {
-            out->nb_samples += s->padd_samples;
+            out->nb_samples = FFMAX(0, out->nb_samples + s->padd_samples);
             s->padd_samples = 0;
         }
         if (!eof)
@@ -1210,23 +1211,26 @@ static int activate(AVFilterContext *ctx)

     FF_FILTER_FORWARD_STATUS_BACK(outlink, inlink);

-    ret = ff_inlink_consume_samples(inlink, s->nb_samples, s->nb_samples, &in);
-    if (ret < 0)
-        return ret;
-    if (ret > 0)
-        return filter_frame(inlink, in);
+    if (!s->eof) {
+        ret = ff_inlink_consume_samples(inlink, s->nb_samples, s->nb_samples, &in);
+        if (ret < 0)
+            return ret;
+        if (ret > 0)
+            return filter_frame(inlink, in);
+    }

     if (ff_inlink_acknowledge_status(inlink, &status, &pts)) {
-        if (status == AVERROR_EOF) {
-            while (s->padd_samples != 0) {
-                ret = filter_frame(inlink, NULL);
-                if (ret < 0)
-                    return ret;
-            }
-            ff_outlink_set_status(outlink, status, pts);
-            return ret;
-        }
+        if (status == AVERROR_EOF)
+            s->eof = 1;
     }
+
+    if (s->eof && s->padd_samples != 0) {
+        return filter_frame(inlink, NULL);
+    } else if (s->eof) {
+        ff_outlink_set_status(outlink, AVERROR_EOF, s->eof_pts);
+        return 0;
+    }
+
     FF_FILTER_FORWARD_WANTED(outlink, inlink);

     return FFERROR_NOT_READY;
--
2.40.0
