This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch release/9.0
in repository ffmpeg.

commit 8af6c71d96f42d277e645d4d9f34e2b39855e3f3
Author:     Jiale Yao <[email protected]>
AuthorDate: Tue Jun 23 04:15:11 2026 +0200
Commit:     Michael Niedermayer <[email protected]>
CommitDate: Tue Jul 21 22:59:48 2026 +0200

    avfilter/vf_vif: Fix out of array access with small dimensions
    
    The hand written boundary mirroring reflected an out of range index only
    once, which is insufficient when the image dimension is smaller than the
    filter half width (filt_w/2 == 8). A 1x1 input made the index reach 8
    and -7, reading out of the src[]/temp[] arrays. Use avpriv_mirror(),
    which mirrors repeatedly and stays in range for any dimension.
    
    Fixes: out of array access
    Fixes: repro.sh
    Fixes: HuQn51lLiVJX
    Fixes: 38aea9b041 (avfilter: add vif filter)
    Signed-off-by: Michael Niedermayer <[email protected]>
    (cherry picked from commit 56309e476ab385881b15fe52634ba2208bb7f4ba)
    Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavfilter/vf_vif.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libavfilter/vf_vif.c b/libavfilter/vf_vif.c
index 64eb39699f..412019a8cf 100644
--- a/libavfilter/vf_vif.c
+++ b/libavfilter/vf_vif.c
@@ -27,6 +27,7 @@
 
 #include <float.h>
 
+#include "libavutil/internal.h"
 #include "libavutil/mem.h"
 #include "libavutil/opt.h"
 #include "libavutil/pixdesc.h"
@@ -238,7 +239,7 @@ static int vif_filter1d(AVFilterContext *ctx, void *arg, 
int jobnr, int nb_jobs)
                     int ii = i - filt_w / 2 + filt_i;
                     float img_coeff;
 
-                    ii = ii < 0 ? -ii : (ii >= h ? 2 * h - ii - 1 : ii);
+                    ii = avpriv_mirror(ii, h - 1);
 
                     img_coeff = src[ii * src_stride + j];
                     sum += filt_coeff * img_coeff;
@@ -267,7 +268,7 @@ static int vif_filter1d(AVFilterContext *ctx, void *arg, 
int jobnr, int nb_jobs)
                     int jj = j - filt_w / 2 + filt_j;
                     float img_coeff;
 
-                    jj = jj < 0 ? -jj : (jj >= w ? 2 * w - jj - 1 : jj);
+                    jj = avpriv_mirror(jj, w - 1);
 
                     img_coeff = temp[jj];
                     sum += filt_coeff * img_coeff;

_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to