diff mbox

[FFmpeg-devel] libavfilter/scale2ref: Fix out-of-bounds array access

Message ID 20170603090419.44431-1-kmark937@gmail.com
State Accepted
Commit 08213e0b7974b7e75d9031d6e448be49a494c0a1
Headers show

Commit Message

Kevin Mark June 3, 2017, 9:04 a.m. UTC
ff_scale_eval_dimensions blindly assumes that two inputs are always
available as of 3385989b98be7940044e4f0a6b431a0a00abf2fa. This is
notably not the case when the function is called for the scale
filter. With the scale filter inputs[1] does not exist.

ff_scale_eval_dimensions now has an updated scale2ref check that
makes certain two inputs are actually available before attempting to
access the second one.

Thanks to James Almer for reporting this bug. This should fix the 820
Valgrind tests I single-handedly managed to break.

Signed-off-by: Kevin Mark <kmark937@gmail.com>
---
 libavfilter/scale.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Michael Niedermayer June 3, 2017, 8:17 p.m. UTC | #1
On Sat, Jun 03, 2017 at 05:04:19AM -0400, Kevin Mark wrote:
> ff_scale_eval_dimensions blindly assumes that two inputs are always
> available as of 3385989b98be7940044e4f0a6b431a0a00abf2fa. This is
> notably not the case when the function is called for the scale
> filter. With the scale filter inputs[1] does not exist.
> 
> ff_scale_eval_dimensions now has an updated scale2ref check that
> makes certain two inputs are actually available before attempting to
> access the second one.
> 
> Thanks to James Almer for reporting this bug. This should fix the 820
> Valgrind tests I single-handedly managed to break.
> 
> Signed-off-by: Kevin Mark <kmark937@gmail.com>
> ---
>  libavfilter/scale.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

applied

thx

[...]
diff mbox

Patch

diff --git a/libavfilter/scale.c b/libavfilter/scale.c
index e3a2fb5923..03745ddcb8 100644
--- a/libavfilter/scale.c
+++ b/libavfilter/scale.c
@@ -115,7 +115,7 @@  int ff_scale_eval_dimensions(void *log_ctx,
     int factor_w, factor_h;
     int eval_w, eval_h;
     int ret;
-    const char scale2ref = outlink->src->inputs[1] == inlink;
+    const char scale2ref = outlink->src->nb_inputs == 2 && outlink->src->inputs[1] == inlink;
     double var_values[VARS_NB + VARS_S2R_NB], res;
     const AVPixFmtDescriptor *main_desc;
     const AVFilterLink *main_link;