This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new db05df9d13 avcodec/cfhd: reject transform-2 output wider than the plane
db05df9d13 is described below
commit db05df9d135fb56a4babb836d5e9f5c1d984e087
Author: Michael Niedermayer <[email protected]>
AuthorDate: Wed Jul 22 05:53:16 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Fri Jul 31 13:18:57 2026 +0000
avcodec/cfhd: reject transform-2 output wider than the plane
Fixes: out of array access
Fixes: cfhd_transform2_output_width_oob.avi
Fixes: MimvoaEVpKow
Found-by: Adrian Junge (vurlo)
---
libavcodec/cfhd.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c
index 4d430e32ef..128362ac62 100644
--- a/libavcodec/cfhd.c
+++ b/libavcodec/cfhd.c
@@ -1224,7 +1224,7 @@ finish:
if (lowpass_height > s->plane[plane].band[4][1].a_height ||
lowpass_width > s->plane[plane].band[4][1].a_width ||
!highpass_stride || s->plane[plane].band[4][1].width >
s->plane[plane].band[4][1].a_width ||
- lowpass_width < 3 || lowpass_height < 3) {
+ lowpass_width < 3 || lowpass_height < 3 || lowpass_width * 2 >
s->plane[plane].width) {
av_log(avctx, AV_LOG_ERROR, "Invalid plane dimensions\n");
ret = AVERROR(EINVAL);
goto end;
@@ -1345,7 +1345,7 @@ finish:
if (lowpass_height > s->plane[plane].band[4][1].a_height ||
lowpass_width > s->plane[plane].band[4][1].a_width ||
s->plane[plane].band[4][1].width >
s->plane[plane].band[4][1].a_width ||
- lowpass_width < 3 || lowpass_height < 3) {
+ lowpass_width < 3 || lowpass_height < 3 || lowpass_width * 2 >
s->plane[plane].width) {
av_log(avctx, AV_LOG_ERROR, "Invalid plane dimensions\n");
ret = AVERROR(EINVAL);
goto end;
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
