diff mbox

[FFmpeg-devel,6/9] avfilter/vf_premultiply: make sure plane count is less than 4

Message ID 20171108181753.6776-7-timo@rothenpieler.org
State New
Headers show

Commit Message

Timo Rothenpieler Nov. 8, 2017, 6:17 p.m. UTC 
Fixes CID #1416350, #1416351, #1416353 and #1416354
---
 libavfilter/vf_premultiply.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

Paul B Mahol Nov. 8, 2017, 7:02 p.m. UTC | #1 
On 11/8/17, Timo Rothenpieler <timo@rothenpieler.org> wrote:
> Fixes CID #1416350, #1416351, #1416353 and #1416354
> ---
>  libavfilter/vf_premultiply.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/libavfilter/vf_premultiply.c b/libavfilter/vf_premultiply.c
> index 5120adc476..1af6433bc9 100644
> --- a/libavfilter/vf_premultiply.c
> +++ b/libavfilter/vf_premultiply.c
> @@ -476,7 +476,7 @@ static int filter_frame(AVFilterContext *ctx,
>              }
>          }
>
> -        for (p = 0; p < s->nb_planes; p++) {
> +        for (p = 0; p < s->nb_planes && p < 4; p++) {
>              if (!((1 << p) & s->planes) || p == 3) {
>                  av_image_copy_plane((*out)->data[p], (*out)->linesize[p],
> base->data[p], base->linesize[p],
>                                      s->linesize[p], s->height[p]);
> @@ -523,6 +523,8 @@ static int config_input(AVFilterLink *inlink)
>      int vsub, hsub, ret;
>
>      s->nb_planes = av_pix_fmt_count_planes(inlink->format);
> +    if (s->nb_planes > 4)
> +        return AVERROR_BUG;
>
>      if ((ret = av_image_fill_linesizes(s->linesize, inlink->format,
> inlink->w)) < 0)
>          return ret;
> --
> 2.14.2
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>

How could this ever happen?

Also, if you committ this bunch of other filters would need same change.
diff mbox

Patch

diff --git a/libavfilter/vf_premultiply.c b/libavfilter/vf_premultiply.c
index 5120adc476..1af6433bc9 100644
--- a/libavfilter/vf_premultiply.c
+++ b/libavfilter/vf_premultiply.c
@@ -476,7 +476,7 @@  static int filter_frame(AVFilterContext *ctx,
             }
         }
 
-        for (p = 0; p < s->nb_planes; p++) {
+        for (p = 0; p < s->nb_planes && p < 4; p++) {
             if (!((1 << p) & s->planes) || p == 3) {
                 av_image_copy_plane((*out)->data[p], (*out)->linesize[p], base->data[p], base->linesize[p],
                                     s->linesize[p], s->height[p]);
@@ -523,6 +523,8 @@  static int config_input(AVFilterLink *inlink)
     int vsub, hsub, ret;
 
     s->nb_planes = av_pix_fmt_count_planes(inlink->format);
+    if (s->nb_planes > 4)
+        return AVERROR_BUG;
 
     if ((ret = av_image_fill_linesizes(s->linesize, inlink->format, inlink->w)) < 0)
         return ret;