lavfi/af_amerge: check for buffer queue overflows.

Without that test, ff_bufqueue_add silently discards the
oldest buffer, that leaves in[i].nb_samples inconsistent,
and causes later a segfault.

diff --git a/libavfilter/af_amerge.c b/libavfilter/af_amerge.c
index 44b71e4..e552682 100644 (file)
--- a/libavfilter/af_amerge.c
+++ b/libavfilter/af_amerge.c
@@ -231,6 +231,11 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *insamples)
         if (inlink == ctx->inputs[input_number])
             break;
     av_assert1(input_number < am->nb_inputs);
+    if (ff_bufqueue_is_full(&am->in[input_number].queue)) {
+        av_log(ctx, AV_LOG_ERROR, "Buffer queue overflow\n");
+        avfilter_unref_buffer(insamples);
+        return AVERROR(ENOMEM);
+    }
     ff_bufqueue_add(ctx, &am->in[input_number].queue, insamples);
     am->in[input_number].nb_samples += insamples->audio->nb_samples;
     nb_samples = am->in[0].nb_samples;