This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 4527854281 avcodec/agm: validate actual src_y against prev plane in
decode_inter_plane
4527854281 is described below
commit 45278542816cab5e8dcb120f9bd62e43ab2857bd
Author: David Korczynski <[email protected]>
AuthorDate: Tue May 26 12:00:00 2026 +0000
Commit: michaelni <[email protected]>
CommitDate: Fri Jun 12 00:47:12 2026 +0000
avcodec/agm: validate actual src_y against prev plane in decode_inter_plane
Found-by: Anthropic agents; validated and reported by Ada Logics.
Signed-off-by: David Korczynski <[email protected]>
Signed-off-by: Michael Niedermayer <[email protected]>
---
libavcodec/agm.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/libavcodec/agm.c b/libavcodec/agm.c
index c13b4d963e..5d27d17274 100644
--- a/libavcodec/agm.c
+++ b/libavcodec/agm.c
@@ -409,12 +409,14 @@ static int decode_inter_plane(AGMContext *s,
GetBitContext *gb, int size,
int map = s->map[x];
if (orig_mv_x >= -32) {
- if (y * 8 + mv_y < 0 || y * 8 + mv_y + 8 > h ||
- x * 8 + mv_x < 0 || x * 8 + mv_x + 8 > w)
+ int src_y = (s->blocks_h - 1 - y) * 8 - mv_y;
+ int src_x = x * 8 + mv_x;
+ if (src_y < 0 || src_y + 8 > h ||
+ src_x < 0 || src_x + 8 > w)
return AVERROR_INVALIDDATA;
copy_block8(frame->data[plane] + (s->blocks_h - 1 - y) * 8
* frame->linesize[plane] + x * 8,
- prev->data[plane] + ((s->blocks_h - 1 - y) * 8
- mv_y) * prev->linesize[plane] + (x * 8 + mv_x),
+ prev->data[plane] + src_y *
prev->linesize[plane] + src_x,
frame->linesize[plane], prev->linesize[plane],
8);
if (map) {
s->idsp.idct(s->wblocks + x * 64);
@@ -446,12 +448,14 @@ static int decode_inter_plane(AGMContext *s,
GetBitContext *gb, int size,
return ret;
if (orig_mv_x >= -32) {
- if (y * 8 + mv_y < 0 || y * 8 + mv_y + 8 > h ||
- x * 8 + mv_x < 0 || x * 8 + mv_x + 8 > w)
+ int src_y = (s->blocks_h - 1 - y) * 8 - mv_y;
+ int src_x = x * 8 + mv_x;
+ if (src_y < 0 || src_y + 8 > h ||
+ src_x < 0 || src_x + 8 > w)
return AVERROR_INVALIDDATA;
copy_block8(frame->data[plane] + (s->blocks_h - 1 - y) * 8
* frame->linesize[plane] + x * 8,
- prev->data[plane] + ((s->blocks_h - 1 - y) * 8
- mv_y) * prev->linesize[plane] + (x * 8 + mv_x),
+ prev->data[plane] + src_y *
prev->linesize[plane] + src_x,
frame->linesize[plane], prev->linesize[plane],
8);
if (map) {
s->idsp.idct(s->block);
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
