sink_buffer: copy list of provided formats in the context

A list of formats may have been dynamically created by the calling code,
and thus should not be referenced by the sink buffer context.

Avoid possible invalid data reference.

1 files changed, 26 insertions, 0 deletions

diff --git a/libavfilter/formats.c b/libavfilter/formats.c
index ff4d49dd5d..fa2c1be4bb 100644
--- a/libavfilter/formats.c
+++ b/libavfilter/formats.c
@@ -93,6 +93,32 @@ int ff_fmt_is_in(int fmt, const int *fmts)
     return 0;
 }
 
+#define COPY_INT_LIST(list_copy, list, type) {                          \
+    int count = 0;                                                      \
+    if (list)                                                           \
+        for (count = 0; list[count] != -1; count++)                     \
+            ;                                                           \
+    list_copy = av_calloc(count+1, sizeof(type));                       \
+    if (list_copy) {                                                    \
+        memcpy(list_copy, list, sizeof(type) * count);                  \
+        list_copy[count] = -1;                                          \
+    }                                                                   \
+}
+
+int *ff_copy_int_list(const int * const list)
+{
+    int *ret = NULL;
+    COPY_INT_LIST(ret, list, int);
+    return ret;
+}
+
+int64_t *ff_copy_int64_list(const int64_t * const list)
+{
+    int64_t *ret = NULL;
+    COPY_INT_LIST(ret, list, int64_t);
+    return ret;
+}
+
 #define MAKE_FORMAT_LIST()                                              \
     AVFilterFormats *formats;                                           \
     int count = 0;                                                      \