This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 86ddc8b438 swscale/output: Fix some integer overflows in
yuv2rgba64_full*()
86ddc8b438 is described below
commit 86ddc8b4383b3de2d1952c196146d447d0652336
Author: Michael Niedermayer <[email protected]>
AuthorDate: Fri Feb 13 00:16:24 2026 +0100
Commit: michaelni <[email protected]>
CommitDate: Thu Feb 26 17:21:46 2026 +0000
swscale/output: Fix some integer overflows in yuv2rgba64_full*()
Fixes: integer overflows
Fixes:
471587361/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-5015347829997568
Found-by: continuous fuzzing process
https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <[email protected]>
---
libswscale/output.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/libswscale/output.c b/libswscale/output.c
index a3b8da54bf..94454860c3 100644
--- a/libswscale/output.c
+++ b/libswscale/output.c
@@ -1416,9 +1416,9 @@ yuv2rgba64_full_X_c_template(SwsInternal *c, const
int16_t *lumFilter,
Y += (1 << 13) - (1<<29); // 21
// 8bit: 17 + 13bit = 30bit, 16bit: 17 + 13bit = 30bit
- R = V * c->yuv2rgb_v2r_coeff;
- G = V * c->yuv2rgb_v2g_coeff + U * c->yuv2rgb_u2g_coeff;
- B = U * c->yuv2rgb_u2b_coeff;
+ R = (unsigned)V * c->yuv2rgb_v2r_coeff;
+ G = (unsigned)V * c->yuv2rgb_v2g_coeff + (unsigned)U *
c->yuv2rgb_u2g_coeff;
+ B = (unsigned)U *
c->yuv2rgb_u2b_coeff;
// 8bit: 30 - 22 = 8bit, 16bit: 30bit - 14 = 16bit
output_pixel(&dest[0], av_clip_uintp2(((int)(R_B + (unsigned)Y)>>14) +
(1<<15), 16));
@@ -1457,9 +1457,9 @@ yuv2rgba64_full_2_c_template(SwsInternal *c, const
int32_t *buf[2],
av_assert2(uvalpha <= 4096U);
for (i = 0; i < dstW; i++) {
- int Y = (int)(buf0[i] * yalpha1 + buf1[i] * yalpha) >> 14;
- int U = (int)(ubuf0[i] * uvalpha1 + ubuf1[i] * uvalpha - (128
<< 23)) >> 14;
- int V = (int)(vbuf0[i] * uvalpha1 + vbuf1[i] * uvalpha - (128
<< 23)) >> 14;
+ unsigned Y = (int)(buf0[i] * yalpha1 + buf1[i] * yalpha) >>
14;
+ unsigned U = (int)(ubuf0[i] * uvalpha1 + ubuf1[i] * uvalpha -
(128 << 23)) >> 14;
+ unsigned V = (int)(vbuf0[i] * uvalpha1 + vbuf1[i] * uvalpha -
(128 << 23)) >> 14;
int R, G, B;
Y -= c->yuv2rgb_y_offset;
@@ -1476,9 +1476,9 @@ yuv2rgba64_full_2_c_template(SwsInternal *c, const
int32_t *buf[2],
A += 1 << 13;
}
- output_pixel(&dest[0], av_clip_uintp2(((R_B + Y) >> 14) + (1<<15),
16));
- output_pixel(&dest[1], av_clip_uintp2((( G + Y) >> 14) + (1<<15),
16));
- output_pixel(&dest[2], av_clip_uintp2(((B_R + Y) >> 14) + (1<<15),
16));
+ output_pixel(&dest[0], av_clip_uintp2(((int)(R_B + Y) >> 14) +
(1<<15), 16));
+ output_pixel(&dest[1], av_clip_uintp2(((int)( G + Y) >> 14) +
(1<<15), 16));
+ output_pixel(&dest[2], av_clip_uintp2(((int)(B_R + Y) >> 14) +
(1<<15), 16));
if (eightbytes) {
output_pixel(&dest[3], av_clip_uintp2(A, 30) >> 14);
dest += 4;
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
