filter_frame() passes the input frame to remap_slice() without verifying that the frame dimensions match the dimensions used to pre-compute the u/v coordinate remap tables in config_output().
When vf_v360 is chained after a scale filter that changes frame dimensions, the pre-computed remap indices can reference pixel positions beyond the actual input buffer, causing heap-buffer-overflow reads and use-after-free reads in remap2_8bit_line_c. Fix by checking in->width/height against the expected input dimensions before processing. Return AVERROR(EINVAL) on mismatch. Found by fuzzing avfilter_graph_parse_ptr() with libFuzzer + AddressSanitizer. Reproduces with 9 distinct inputs (26-78 bytes). Crash trace: #0 remap2_8bit_line_c libavfilter/vf_v360.c:369 #1 remap2_8bit_slice libavfilter/vf_v360.c:333 #2 filter_frame libavfilter/vf_v360.c:4921 #3 ff_filter_activate libavfilter/avfilter.c:1456 Minimal reproducer (26-byte filter graph string): scale=6\xff46630,v360=\x00%@\xff\xffB Signed-off-by: Anthony Hurtado <[email protected]> --- libavfilter/vf_v360.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/libavfilter/vf_v360.c b/libavfilter/vf_v360.c index a082798..e65c1d8 100644 --- a/libavfilter/vf_v360.c +++ b/libavfilter/vf_v360.c @@ -4908,6 +4908,15 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in) AVFrame *out; ThreadData td; + if (in->width != s->inplanewidth[0] || in->height != s->inplaneheight[0]) { + av_log(ctx, AV_LOG_ERROR, + "Input frame size %dx%d does not match expected size %dx%d\n", + in->width, in->height, + s->inplanewidth[0], s->inplaneheight[0]); + av_frame_free(&in); + return AVERROR(EINVAL); + } + out = ff_get_video_buffer(outlink, outlink->w, outlink->h); if (!out) { av_frame_free(&in); -- 2.47.3 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
