PR #22586 opened by Zhao Zhili (quink) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22586 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22586.patch
tape_length * 8 overflows 32-bit int for large input widths. Then av_malloc_array() allocating a tiny buffer while the subsequent loop writes tape_length*8 BilinearMap entries, causing heap-buffer-overflow. Fixes: #21511 Signed-off-by: Zhao Zhili <[email protected]> >From eb1e546b17a32866382a05ea1a128923149d8a11 Mon Sep 17 00:00:00 2001 From: Zhao Zhili <[email protected]> Date: Mon, 23 Mar 2026 16:21:24 +0800 Subject: [PATCH] avfilter/vf_ssim360: fix integer overflow in tape_length allocation tape_length * 8 overflows 32-bit int for large input widths. Then av_malloc_array() allocating a tiny buffer while the subsequent loop writes tape_length*8 BilinearMap entries, causing heap-buffer-overflow. Fixes: #21511 Signed-off-by: Zhao Zhili <[email protected]> --- libavfilter/vf_ssim360.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libavfilter/vf_ssim360.c b/libavfilter/vf_ssim360.c index 4c9971efdd..f814fbf8f0 100644 --- a/libavfilter/vf_ssim360.c +++ b/libavfilter/vf_ssim360.c @@ -1036,8 +1036,11 @@ generate_eye_tape_map(SSIM360Context *s, // Ensure tape length is a multiple of 4, for full SSIM block coverage int tape_length = s->tape_length[plane] = ((int)ROUNDED_DIV(x_range, 4)) << 2; - s->ref_tape_map[plane][eye] = av_malloc_array(tape_length * 8, sizeof(BilinearMap)); - s->main_tape_map[plane][eye] = av_malloc_array(tape_length * 8, sizeof(BilinearMap)); + if (tape_length <= 0) + return AVERROR(EINVAL); + + s->ref_tape_map[plane][eye] = av_malloc_array(tape_length, 8 * sizeof(BilinearMap)); + s->main_tape_map[plane][eye] = av_malloc_array(tape_length, 8 * sizeof(BilinearMap)); if (!s->ref_tape_map[plane][eye] || !s->main_tape_map[plane][eye]) return AVERROR(ENOMEM); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
