Anthony Hurtado via ffmpeg-devel (HE12026-04-10): > filter_frame() passes the input frame to remap_slice() without > verifying that the frame dimensions match the dimensions used to > pre-compute the u/v coordinate remap tables in config_output(). > > When vf_v360 is chained after a scale filter that changes frame > dimensions, the pre-computed remap indices can reference pixel > positions beyond the actual input buffer, causing heap-buffer-overflow > reads and use-after-free reads in remap2_8bit_line_c.
Did we not have framework protections to only send frames with variable dimensions to filters that support them? I thought we had them, but I cannot find them in the code nor removed in the log. Can anybody remember what happened? Anyway, if we did not have them, we should, this is an issue likely to affect many filters. Regards, -- Nicolas George _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
