PR #24205 opened by haochenc URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24205 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24205.patch
Fix stride condition when bounding w. Signed-off-by: Hao Chen <[email protected]> # Summary of changes This PR fixes a bounds-checking bug in the AArch64 NEON implementation of `vf_bwdif_init_aarch64.c`. The underlying assembly function operates on 16-byte chunks. The code previously attempted to take a shortcut: if the image width `w` is not a multiple of 16, but both the destination and source strides have enough padding to contain the rounded-up width (`FFALIGN(w, 16)`), it allows the assembly code to safely overwrite the padding bytes. This avoids the overhead of dropping into a slow C fallback for the tail pixels. However, the logic erroneously checked if the strides were *less than or equal to* the padded width (`d_stride <= w1 && s_stride <= w1`), rather than *greater than or equal to* (`>=`). This could lead to out-of-bounds writes and memory corruption by incorrectly taking the shortcut when padding bytes are not actually available, causing the assembly loop to trample over the adjacent scanline's data. This commit fixes the condition to correctly ensure `d_stride >= w1 && s_stride >= w1`. <!-- If this PR requires new FATE test samples, attach them to the PR and list their target paths below (relative to the fate-suite root). Attached filenames must match the sample's filename: ```fate-samples # e.g. vorbis/new-sample.ogg >From 8dd232a1b949ac98c6e94d119bc17df0a7292c23 Mon Sep 17 00:00:00 2001 From: Hao Chen <[email protected]> Date: Fri, 14 Aug 2026 19:42:47 +0000 Subject: [PATCH] avfilter/aarch64/vf_bwdif_init: Fix stride bound check Fix stride condition when bounding w. Signed-off-by: Hao Chen <[email protected]> --- libavfilter/aarch64/vf_bwdif_init_aarch64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavfilter/aarch64/vf_bwdif_init_aarch64.c b/libavfilter/aarch64/vf_bwdif_init_aarch64.c index efcb31efff..9b83865bdb 100644 --- a/libavfilter/aarch64/vf_bwdif_init_aarch64.c +++ b/libavfilter/aarch64/vf_bwdif_init_aarch64.c @@ -52,7 +52,7 @@ static void filter_line3_helper(void * dst1, int d_stride, // having to invoke the C version to clean up the tail. const int w1 = FFALIGN(w, 16); const int w0 = clip_max != 255 ? 0 : - d_stride <= w1 && s_stride <= w1 ? w : w & ~15; + d_stride >= w1 && s_stride >= w1 ? w : w & ~15; ff_bwdif_filter_line3_neon(dst1, d_stride, prev1, cur1, next1, s_stride, -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
