PR #22839 opened by Kacper Michajłow (kasper93) URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22839 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22839.patch
When use_loop == true and idx < 0, we would incorrectly check in_stride[idx], which is OOB read. Check !use_loop first, as we know by the condition above that idx >= 0 has to be true in this case. From 3ada2b6c8a27ffbebe3998c41ee0eebae92e2870 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= <[email protected]> Date: Thu, 16 Apr 2026 19:42:19 +0200 Subject: [PATCH] swscale/ops_memcpy: guard exec->in_stride[-1] access MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When use_loop == true and idx < 0, we would incorrectly check in_stride[idx], which is OOB read. Check !use_loop first, as we know by the condition above that idx >= 0 has to be true in this case. Signed-off-by: Kacper Michajłow <[email protected]> --- libswscale/ops_memcpy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libswscale/ops_memcpy.c b/libswscale/ops_memcpy.c index 4d0477b754..d168e3135e 100644 --- a/libswscale/ops_memcpy.c +++ b/libswscale/ops_memcpy.c @@ -51,7 +51,7 @@ static void process(const SwsOpExec *exec, const void *priv, const int use_loop = exec->out_stride[i] > bytes + SWS_MAX_PADDING; if (idx < 0 && !use_loop) { memset(out, p->clear_value[i], exec->out_stride[i] * lines); - } else if (exec->out_stride[i] == exec->in_stride[idx] && !use_loop) { + } else if (!use_loop && exec->out_stride[i] == exec->in_stride[idx]) { memcpy(out, exec->in[idx], exec->out_stride[i] * lines); } else if (idx < 0) { for (int y = y_start; y < y_end; y++) { -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
