This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new a7e38b617b avfilter/vf_swaprect: size the temp row buffer for the
widest plane
a7e38b617b is described below
commit a7e38b617b32f996beaa371bbf04b39907d7a527
Author: Michael Niedermayer <[email protected]>
AuthorDate: Sat Jul 11 16:46:39 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Mon Jul 13 18:22:46 2026 +0000
avfilter/vf_swaprect: size the temp row buffer for the widest plane
Fixes: out of array access
Fixes: 7aj_swaprect_odd17_nv12.nut / 7aj_generate_swaprect_odd17_nv12.py
Fixes: VRAXYvKtmKa8
Found-by: Adrian Junge (vurlo) <[email protected]>
---
libavfilter/vf_swaprect.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/libavfilter/vf_swaprect.c b/libavfilter/vf_swaprect.c
index 5d93f51c30..fe007ee5e7 100644
--- a/libavfilter/vf_swaprect.c
+++ b/libavfilter/vf_swaprect.c
@@ -200,6 +200,7 @@ static int config_input(AVFilterLink *inlink)
{
AVFilterContext *ctx = inlink->dst;
SwapRectContext *s = ctx->priv;
+ int size = 0;
if (!s->w || !s->h ||
!s->x1 || !s->y1 ||
@@ -210,7 +211,16 @@ static int config_input(AVFilterLink *inlink)
av_image_fill_max_pixsteps(s->pixsteps, NULL, s->desc);
s->nb_planes = av_pix_fmt_count_planes(inlink->format);
- s->temp = av_malloc_array(inlink->w, s->pixsteps[0]);
+ for (int p = 0; p < s->nb_planes; p++) {
+ int shift = p == 1 || p == 2 ? s->desc->log2_chroma_w : 0;
+ int width = AV_CEIL_RSHIFT(inlink->w, shift);
+
+ if (width > INT_MAX / s->pixsteps[p])
+ return AVERROR(EINVAL);
+ size = FFMAX(size, width * s->pixsteps[p]);
+ }
+
+ s->temp = av_malloc(size);
if (!s->temp)
return AVERROR(ENOMEM);
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
