This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 2ec918330eee04f6069e9561a0d3950b7b52fc5e Author: Pavel Kohout <[email protected]> AuthorDate: Tue Jun 30 21:52:47 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Tue Jul 21 22:59:51 2026 +0200 avfilter/boxblur: reject pixel formats deeper than 16 bits Fixes: heap buffer overflow Fixes: CRufFb6TVikL Fixes: dee7440531 (vf_boxblur: Templatize blur{8,16}) Found-by: Pavel Kohout (Aisle Research) Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 0dac41d2e5e0f4251ed89eedb03a847d5d59ef67) Signed-off-by: Michael Niedermayer <[email protected]> --- libavfilter/vf_boxblur.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/libavfilter/vf_boxblur.c b/libavfilter/vf_boxblur.c index 3cb42471a7..8d9649172a 100644 --- a/libavfilter/vf_boxblur.c +++ b/libavfilter/vf_boxblur.c @@ -25,6 +25,7 @@ * Ported from MPlayer libmpcodecs/vf_boxblur.c. */ +#include "libavutil/avassert.h" #include "libavutil/common.h" #include "libavutil/mem.h" #include "libavutil/opt.h" @@ -65,6 +66,7 @@ static int query_formats(const AVFilterContext *ctx, for (fmt = 0; av_pix_fmt_desc_get(fmt); fmt++) { const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(fmt); if (!(desc->flags & (AV_PIX_FMT_FLAG_HWACCEL | AV_PIX_FMT_FLAG_BITSTREAM | AV_PIX_FMT_FLAG_PAL)) && + desc->comp[0].depth <= 16 && (desc->flags & AV_PIX_FMT_FLAG_PLANAR || desc->nb_components == 1) && (!(desc->flags & AV_PIX_FMT_FLAG_BE) == !HAVE_BIGENDIAN || desc->comp[0].depth == 8) && (ret = ff_add_format(&formats, fmt)) < 0) @@ -163,7 +165,10 @@ static inline void blur(uint8_t *dst, int dst_step, const uint8_t *src, int src_ int len, int radius, int pixsize) { if (pixsize == 1) blur8 (dst, dst_step , src, src_step , len, radius); - else blur16((uint16_t*)dst, dst_step>>1, (const uint16_t*)src, src_step>>1, len, radius); + else if (pixsize == 2) + blur16((uint16_t*)dst, dst_step>>1, (const uint16_t*)src, src_step>>1, len, radius); + else + av_assert0(0); } static inline void blur_power(uint8_t *dst, int dst_step, const uint8_t *src, int src_step, _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
