diff mbox series

[FFmpeg-devel,2/3] avfilter/vf_vmafmotion: Check dimensions

Message ID 20210529093530.15419-2-michael@niedermayer.cc
State Accepted
Commit 82ad1b76751bcfad5005440db48c46a4de5d6f02
Headers show
Series [FFmpeg-devel,1/3] avformat/movenc: Check pal_size before use | expand

Checks

Context Check Description
andriy/x86_make success Make finished
andriy/x86_make_fate success Make fate finished
andriy/PPC64_make success Make finished
andriy/PPC64_make_fate success Make fate finished

Commit Message

Michael Niedermayer May 29, 2021, 9:35 a.m. UTC 
Fixes: out of array access
Fixes: Ticket8241
Fixes: Ticket8246
Fixes: CVE-2020-22019
Fixes: CVE-2020-22033

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/vf_vmafmotion.c | 3 +++
 1 file changed, 3 insertions(+)
diff mbox series

Patch

diff --git a/libavfilter/vf_vmafmotion.c b/libavfilter/vf_vmafmotion.c
index 2db4783d8d..454ebb8afa 100644
--- a/libavfilter/vf_vmafmotion.c
+++ b/libavfilter/vf_vmafmotion.c
@@ -238,6 +238,9 @@  int ff_vmafmotion_init(VMAFMotionData *s,
     int i;
     const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(fmt);
 
+    if (w < 3 || h < 3)
+        return AVERROR(EINVAL);
+
     s->width = w;
     s->height = h;
     s->stride = FFALIGN(w * sizeof(uint16_t), 32);