This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit b3c7ebc1edc401fd9881277fdfae93f3f24ceb81 Author: Michael Niedermayer <[email protected]> AuthorDate: Sat Jul 11 16:46:39 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Tue Jul 21 22:59:59 2026 +0200 avfilter/vf_swaprect: size the temp row buffer for the widest plane Fixes: out of array access Fixes: 7aj_swaprect_odd17_nv12.nut / 7aj_generate_swaprect_odd17_nv12.py Fixes: VRAXYvKtmKa8 Found-by: Adrian Junge (vurlo) <[email protected]> (cherry picked from commit a7e38b617b32f996beaa371bbf04b39907d7a527) Signed-off-by: Michael Niedermayer <[email protected]> --- libavfilter/vf_swaprect.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/libavfilter/vf_swaprect.c b/libavfilter/vf_swaprect.c index 5d93f51c30..fe007ee5e7 100644 --- a/libavfilter/vf_swaprect.c +++ b/libavfilter/vf_swaprect.c @@ -200,6 +200,7 @@ static int config_input(AVFilterLink *inlink) { AVFilterContext *ctx = inlink->dst; SwapRectContext *s = ctx->priv; + int size = 0; if (!s->w || !s->h || !s->x1 || !s->y1 || @@ -210,7 +211,16 @@ static int config_input(AVFilterLink *inlink) av_image_fill_max_pixsteps(s->pixsteps, NULL, s->desc); s->nb_planes = av_pix_fmt_count_planes(inlink->format); - s->temp = av_malloc_array(inlink->w, s->pixsteps[0]); + for (int p = 0; p < s->nb_planes; p++) { + int shift = p == 1 || p == 2 ? s->desc->log2_chroma_w : 0; + int width = AV_CEIL_RSHIFT(inlink->w, shift); + + if (width > INT_MAX / s->pixsteps[p]) + return AVERROR(EINVAL); + size = FFMAX(size, width * s->pixsteps[p]); + } + + s->temp = av_malloc(size); if (!s->temp) return AVERROR(ENOMEM); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
