PR #24753 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24753 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24753.patch
>From dbbe544b6fbf4bb16ef65ab73f870ebcf061f2a7 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 28 Sep 2026 04:18:41 +0000 Subject: [PATCH 1/5] avfilter/vf_libopencv: let the shape file alone define the element size For CV_SHAPE_CUSTOM the documentation states that cols and rows from the filter parameters are ignored and the size is taken from the file, but read_shape_from_file() used the caller supplied values as a baseline: *rows was incremented and *cols was raised to the file width. Reset both so that only the file content matters. This also removes two remaining out-of-bounds accesses in the fill loop, which are reachable with a custom shape file whose content is empty or whose last line lacks the terminating newline. Assisted-by: Fairy --- libavfilter/vf_libopencv.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavfilter/vf_libopencv.c b/libavfilter/vf_libopencv.c index b8366a00c7..a650a42c77 100644 --- a/libavfilter/vf_libopencv.c +++ b/libavfilter/vf_libopencv.c @@ -136,6 +136,9 @@ static int read_shape_from_file(int *cols, int *rows, int **values, const char * if ((ret = av_file_map(filename, &buf, &size, 0, log_ctx)) < 0) return ret; + /* the file alone defines the size of the shape */ + *cols = *rows = 0; + /* prescan file to get the number of lines and the maximum width */ w = 0; for (i = 0; i < size; i++) { -- 2.52.0 >From e168ce8ee33ef480ca823c717b0a7da905437e58 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 28 Sep 2026 17:27:58 +0200 Subject: [PATCH 2/5] avfilter/vf_libopencv: index the shape file with size_t Fixes: signed integer overflow Found during review of the read_shape_from_file() fixes --- libavfilter/vf_libopencv.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavfilter/vf_libopencv.c b/libavfilter/vf_libopencv.c index a650a42c77..e9b5cdc7d0 100644 --- a/libavfilter/vf_libopencv.c +++ b/libavfilter/vf_libopencv.c @@ -130,8 +130,8 @@ static int read_shape_from_file(int *cols, int *rows, int **values, const char * void *log_ctx) { uint8_t *buf, *p, *pend; - size_t size; - int ret, i, j, w; + size_t size, i; + int ret, j, w; if ((ret = av_file_map(filename, &buf, &size, 0, log_ctx)) < 0) return ret; @@ -201,7 +201,7 @@ end: for (j = 0; j < *cols; j++) line[j] = (*values)[i * *cols + j] ? '@' : ' '; line[j] = 0; - av_log(log_ctx, AV_LOG_DEBUG, "%3d: %s\n", i, line); + av_log(log_ctx, AV_LOG_DEBUG, "%3zu: %s\n", i, line); } av_free(line); } -- 2.52.0 >From 451dbb399ba15fb09ea30fb3fbd305b254293b3f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 28 Sep 2026 17:28:16 +0200 Subject: [PATCH 3/5] avfilter/vf_libopencv: do not count the newline into the width of the following line Fixes: structuring element one column too wide Found during review of the read_shape_from_file() fixes --- libavfilter/vf_libopencv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavfilter/vf_libopencv.c b/libavfilter/vf_libopencv.c index e9b5cdc7d0..ecc0edde9e 100644 --- a/libavfilter/vf_libopencv.c +++ b/libavfilter/vf_libopencv.c @@ -155,8 +155,8 @@ static int read_shape_from_file(int *cols, int *rows, int **values, const char * av_log(log_ctx, AV_LOG_ERROR, "Overflow on the number of columns in the file\n"); ret = AVERROR_INVALIDDATA; goto end; - } - w++; + } else + w++; } if (*cols == 0) { av_log(log_ctx, AV_LOG_ERROR, "No columns in the shape file\n"); -- 2.52.0 >From 6b7f32b9cede41f3d7d79f207746580feddda7e0 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 28 Sep 2026 17:28:30 +0200 Subject: [PATCH 4/5] avfilter/vf_libopencv: count a last line without terminating newline Fixes: last row of the shape file dropped Found during review of the read_shape_from_file() fixes --- libavfilter/vf_libopencv.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/libavfilter/vf_libopencv.c b/libavfilter/vf_libopencv.c index ecc0edde9e..7888d8f18c 100644 --- a/libavfilter/vf_libopencv.c +++ b/libavfilter/vf_libopencv.c @@ -139,10 +139,11 @@ static int read_shape_from_file(int *cols, int *rows, int **values, const char * /* the file alone defines the size of the shape */ *cols = *rows = 0; - /* prescan file to get the number of lines and the maximum width */ + /* prescan file to get the number of lines and the maximum width, + * the last line need not be newline terminated */ w = 0; - for (i = 0; i < size; i++) { - if (buf[i] == '\n') { + for (i = 0; i < size || w; i++) { + if (i == size || buf[i] == '\n') { if (*rows == INT_MAX) { av_log(log_ctx, AV_LOG_ERROR, "Overflow on the number of rows in the file\n"); ret = AVERROR_INVALIDDATA; -- 2.52.0 >From dbca40a9927dfa191920d852d8555833fafc9a6d Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Mon, 28 Sep 2026 17:28:30 +0200 Subject: [PATCH 5/5] avfilter/vf_libopencv: free the shape values when read_shape_from_file() fails Fixes: memleak Found during review of the read_shape_from_file() fixes --- libavfilter/vf_libopencv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavfilter/vf_libopencv.c b/libavfilter/vf_libopencv.c index 7888d8f18c..cdfa678860 100644 --- a/libavfilter/vf_libopencv.c +++ b/libavfilter/vf_libopencv.c @@ -225,7 +225,7 @@ static int parse_iplconvkernel(IplConvKernel **kernel, char *buf, void *log_ctx) else if (!strcmp(shape_str, "custom" )) { shape = CV_SHAPE_CUSTOM; if ((ret = read_shape_from_file(&cols, &rows, &values, shape_filename, log_ctx)) < 0) - return ret; + goto out; } else { av_log(log_ctx, AV_LOG_ERROR, "Shape unspecified or type '%s' unknown.\n", shape_str); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
