This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 24c322fdb232d0a3f3790d544dcb64e5c2138e79 Author: Michael Niedermayer <[email protected]> AuthorDate: Sat Jul 11 16:47:28 2026 +0200 Commit: michaelni <[email protected]> CommitDate: Mon Jul 13 17:14:54 2026 +0000 avfilter/vf_floodfill: size the point stack for the current frame Fixes: out of array access Fixes: 8aj_floodfill_dynamic_size.pgm / 8aj_generate_floodfill_dynamic_size_pgm.py Fixes: 3MleMXjGZvu3 Found-by: Adrian Junge (vurlo) <[email protected]> --- libavfilter/vf_floodfill.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/libavfilter/vf_floodfill.c b/libavfilter/vf_floodfill.c index 6d89963e71..e569d5f586 100644 --- a/libavfilter/vf_floodfill.c +++ b/libavfilter/vf_floodfill.c @@ -41,6 +41,7 @@ typedef struct FloodfillContext { int nb_planes; int back, front; Points *points; + unsigned int points_size; int (*is_same)(const AVFrame *frame, int x, int y, unsigned s0, unsigned s1, unsigned s2, unsigned s3); @@ -271,9 +272,6 @@ static int config_input(AVFilterLink *inlink) } s->front = s->back = 0; - s->points = av_calloc(inlink->w * inlink->h, 4 * sizeof(Points)); - if (!s->points) - return AVERROR(ENOMEM); return 0; } @@ -292,8 +290,23 @@ static int filter_frame(AVFilterLink *link, AVFrame *frame) int s3 = s->s[3]; const int w = frame->width; const int h = frame->height; + size_t nb_points, points_size; int i, ret; + if (w > UINT16_MAX + 1 || h > UINT16_MAX + 1 || + av_size_mult(w, h, &nb_points) < 0 || + av_size_mult(nb_points, 4 * sizeof(*s->points), &points_size) < 0) { + av_frame_free(&frame); + return AVERROR(EINVAL); + } + + av_fast_malloc(&s->points, &s->points_size, points_size); + if (!s->points) { + av_frame_free(&frame); + return AVERROR(ENOMEM); + } + s->front = s->back = 0; + if (is_inside(s->x, s->y, w, h)) { s->pick_pixel(frame, s->x, s->y, &s0, &s1, &s2, &s3); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
