From 5a2f87c1903237166785adb560acc02461fe9be0 Mon Sep 17 00:00:00 2001 From: zhang xingxing <2388969553@qq.com> Date: Tue, 13 Oct 2026 06:40:15 +0200 Subject: [PATCH] avfilter/vf_libvmaf: reject a feature config without a name This is not a security issue. Fixes: 1QLxiyziAd9N Fixes: swarm-NULL-feature_name-dereferenced-in-parse_features-129e69 Regression since: 3d29724c00 NULL feature name Replicated through UnModified FFmpeg (the error message read "(null)") Found-by: zhang xingxing <2388969553@qq.com> Signed-off-by: Michael Niedermayer --- libavfilter/vf_libvmaf.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/libavfilter/vf_libvmaf.c b/libavfilter/vf_libvmaf.c index 3ab67d3dba..4771541664 100644 --- a/libavfilter/vf_libvmaf.c +++ b/libavfilter/vf_libvmaf.c @@ -239,30 +239,36 @@ static int parse_features(AVFilterContext *ctx) } for (unsigned i = 0; i < dict_cnt; i++) { - char *feature_name = NULL; + const AVDictionaryEntry *name = av_dict_get(dict[i], "name", NULL, + AV_DICT_MATCH_CASE); VmafFeatureDictionary *feature_opts_dict = NULL; const AVDictionaryEntry *e = NULL; + if (!name) { + av_log(ctx, AV_LOG_ERROR, "feature without a name: %s\n", + s->feature_cfg); + err = AVERROR(EINVAL); + goto exit; + } + while (e = av_dict_iterate(dict[i], e)) { - if (!strcmp(e->key, "name")) { - feature_name = e->value; + if (!strcmp(e->key, "name")) continue; - } err = vmaf_feature_dictionary_set(&feature_opts_dict, e->key, e->value); if (err) { av_log(ctx, AV_LOG_ERROR, "could not set feature option: %s.%s=%s\n", - feature_name, e->key, e->value); + name->value, e->key, e->value); goto exit; } } - err = vmaf_use_feature(s->vmaf, feature_name, feature_opts_dict); + err = vmaf_use_feature(s->vmaf, name->value, feature_opts_dict); if (err) { av_log(ctx, AV_LOG_ERROR, - "problem during vmaf_use_feature: %s\n", feature_name); + "problem during vmaf_use_feature: %s\n", name->value); goto exit; } }