[FFmpeg-devel] lavfi/deshake: fix deshake crash issue.

Submitted by Jun Zhao on Sept. 18, 2018, 1:37 p.m.

Details

Message ID 1537277849-14671-1-git-send-email-mypopydev@gmail.com
State Accepted
Headers show

Commit Message

Jun Zhao Sept. 18, 2018, 1:37 p.m.
Fixes ticket #7441.

Signed-off-by: Jun Zhao <mypopydev@gmail.com>
---
 libavfilter/vf_deshake.c |   12 +++++++-----
 1 files changed, 7 insertions(+), 5 deletions(-)

Comments

Michael Niedermayer Sept. 19, 2018, 11:07 a.m.
On Tue, Sep 18, 2018 at 09:37:29PM +0800, Jun Zhao wrote:
> Fixes ticket #7441.
> 
> Signed-off-by: Jun Zhao <mypopydev@gmail.com>
> ---
>  libavfilter/vf_deshake.c |   12 +++++++-----
>  1 files changed, 7 insertions(+), 5 deletions(-)

this doesnt look correct

the blocks that will be used are not going out of array? so the contrast
calculated from them also should not

[...]
mypopy@gmail.com Sept. 20, 2018, 2:39 a.m.
On Wed, Sep 19, 2018 at 7:07 PM Michael Niedermayer
<michael@niedermayer.cc> wrote:
>
> On Tue, Sep 18, 2018 at 09:37:29PM +0800, Jun Zhao wrote:
> > Fixes ticket #7441.
> >
> > Signed-off-by: Jun Zhao <mypopydev@gmail.com>
> > ---
> >  libavfilter/vf_deshake.c |   12 +++++++-----
> >  1 files changed, 7 insertions(+), 5 deletions(-)
>
> this doesnt look correct
>
> the blocks that will be used are not going out of array? so the contrast
> calculated from them also should not
>
Do you mean the correct way is changing the pos calculated from:
pos = (y - i) * stride + (x - j);  to  pos = (y + i) * stride + (x + j)  ?
Michael Niedermayer Sept. 21, 2018, 7:24 p.m.
On Thu, Sep 20, 2018 at 10:39:37AM +0800, mypopy@gmail.com wrote:
> On Wed, Sep 19, 2018 at 7:07 PM Michael Niedermayer
> <michael@niedermayer.cc> wrote:
> >
> > On Tue, Sep 18, 2018 at 09:37:29PM +0800, Jun Zhao wrote:
> > > Fixes ticket #7441.
> > >
> > > Signed-off-by: Jun Zhao <mypopydev@gmail.com>
> > > ---
> > >  libavfilter/vf_deshake.c |   12 +++++++-----
> > >  1 files changed, 7 insertions(+), 5 deletions(-)
> >
> > this doesnt look correct
> >
> > the blocks that will be used are not going out of array? so the contrast
> > calculated from them also should not
> >
> Do you mean the correct way is changing the pos calculated from:
> pos = (y - i) * stride + (x - j);  to  pos = (y + i) * stride + (x + j)  ?

Iam not the author of vf_deshake, but whatever aligns the checked blocks 
correctly, should be the correct solution

[...]
Colin NG Sept. 21, 2018, 10:52 p.m.
1) The crash is caused by accessing un-allocated  memory area.
2) You can't compute the contrast outside of search window (by default, rx=ry=16).
mypopy@gmail.com Sept. 22, 2018, 2:30 a.m.
On Sat, Sep 22, 2018 at 6:52 AM Colin NG <colin_ng@hotmail.com> wrote:
>
> 1) The crash is caused by accessing un-allocated  memory area.
> 2) You can't compute the contrast outside of search window (by default, rx=ry=16).
>

Yes, so I give other fix in https://patchwork.ffmpeg.org/patch/10426/,
can you help to review or comment? Thanks.

> ________________________________
> From: ffmpeg-devel <ffmpeg-devel-bounces@ffmpeg.org> on behalf of Michael Niedermayer <michael@niedermayer.cc>
> Sent: September 21, 2018 3:24 PM
> To: FFmpeg development discussions and patches
> Subject: Re: [FFmpeg-devel] [PATCH] lavfi/deshake: fix deshake crash issue.
>
> On Thu, Sep 20, 2018 at 10:39:37AM +0800, mypopy@gmail.com wrote:
> > On Wed, Sep 19, 2018 at 7:07 PM Michael Niedermayer
> > <michael@niedermayer.cc> wrote:
> > >
> > > On Tue, Sep 18, 2018 at 09:37:29PM +0800, Jun Zhao wrote:
> > > > Fixes ticket #7441.
> > > >
> > > > Signed-off-by: Jun Zhao <mypopydev@gmail.com>
> > > > ---
> > > >  libavfilter/vf_deshake.c |   12 +++++++-----
> > > >  1 files changed, 7 insertions(+), 5 deletions(-)
> > >
> > > this doesnt look correct
> > >
> > > the blocks that will be used are not going out of array? so the contrast
> > > calculated from them also should not
> > >
> > Do you mean the correct way is changing the pos calculated from:
> > pos = (y - i) * stride + (x - j);  to  pos = (y + i) * stride + (x + j)  ?
>
> Iam not the author of vf_deshake, but whatever aligns the checked blocks
> correctly, should be the correct solution
>
> [...]
> --
> Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
>
> Modern terrorism, a quick summary: Need oil, start war with country that
> has oil, kill hundread thousand in war. Let country fall into chaos,
> be surprised about raise of fundamantalists. Drop more bombs, kill more
> people, be surprised about them taking revenge and drop even more bombs
> and strip your own citizens of their rights and freedoms. to be continued
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
mypopy@gmail.com Sept. 22, 2018, 2:33 a.m.
On Sat, Sep 22, 2018 at 3:25 AM Michael Niedermayer
<michael@niedermayer.cc> wrote:
>
> On Thu, Sep 20, 2018 at 10:39:37AM +0800, mypopy@gmail.com wrote:
> > On Wed, Sep 19, 2018 at 7:07 PM Michael Niedermayer
> > <michael@niedermayer.cc> wrote:
> > >
> > > On Tue, Sep 18, 2018 at 09:37:29PM +0800, Jun Zhao wrote:
> > > > Fixes ticket #7441.
> > > >
> > > > Signed-off-by: Jun Zhao <mypopydev@gmail.com>
> > > > ---
> > > >  libavfilter/vf_deshake.c |   12 +++++++-----
> > > >  1 files changed, 7 insertions(+), 5 deletions(-)
> > >
> > > this doesnt look correct
> > >
> > > the blocks that will be used are not going out of array? so the contrast
> > > calculated from them also should not
> > >
> > Do you mean the correct way is changing the pos calculated from:
> > pos = (y - i) * stride + (x - j);  to  pos = (y + i) * stride + (x + j)  ?
>
> Iam not the author of vf_deshake, but whatever aligns the checked blocks
> correctly, should be the correct solution

Agree, so I submitted V2 patch for this issue, Thanks.

>
> [...]
> --
> Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB
>
> Modern terrorism, a quick summary: Need oil, start war with country that
> has oil, kill hundread thousand in war. Let country fall into chaos,
> be surprised about raise of fundamantalists. Drop more bombs, kill more
> people, be surprised about them taking revenge and drop even more bombs
> and strip your own citizens of their rights and freedoms. to be continued
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel

Patch hide | download patch | download mbox

diff --git a/libavfilter/vf_deshake.c b/libavfilter/vf_deshake.c
index 55ce5e1..5d2c7fa 100644
--- a/libavfilter/vf_deshake.c
+++ b/libavfilter/vf_deshake.c
@@ -196,11 +196,13 @@  static int block_contrast(uint8_t *src, int x, int y, int stride, int blocksize)
     for (i = 0; i <= blocksize * 2; i++) {
         // We use a width of 16 here to match the sad function
         for (j = 0; j <= 15; j++) {
-            pos = (y - i) * stride + (x - j);
-            if (src[pos] < lowest)
-                lowest = src[pos];
-            else if (src[pos] > highest) {
-                highest = src[pos];
+            if (y >= i) {
+                pos = (y - i) * stride + (x - j);
+                if (src[pos] < lowest)
+                    lowest = src[pos];
+                else if (src[pos] > highest) {
+                    highest = src[pos];
+                }
             }
         }
     }