diff mbox series

[FFmpeg-devel,1/2] avfilter/edge_template: Fix small inputs with gaussian_blur()

Message ID 20231222115152.12329-1-michael@niedermayer.cc
State Accepted
Commit c443658d26d2b8e19901f9507a890e0efca79056
Headers show
Series [FFmpeg-devel,1/2] avfilter/edge_template: Fix small inputs with gaussian_blur() | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Michael Niedermayer Dec. 22, 2023, 11:51 a.m. UTC 
Fixes: out of array access
Fixes: Ticket10699
Fixes: poc5ffmpeg

Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/edge_template.c | 29 +++++++++++++++++++----------
 1 file changed, 19 insertions(+), 10 deletions(-)

Comments

Michael Niedermayer Dec. 29, 2023, 12:30 a.m. UTC | #1 
On Fri, Dec 22, 2023 at 12:51:51PM +0100, Michael Niedermayer wrote:
> Fixes: out of array access
> Fixes: Ticket10699
> Fixes: poc5ffmpeg
> 
> Found-by: Zeng Yunxiang
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavfilter/edge_template.c | 29 +++++++++++++++++++----------
>  1 file changed, 19 insertions(+), 10 deletions(-)

will apply patchset

[...]
diff mbox series

Patch

diff --git a/libavfilter/edge_template.c b/libavfilter/edge_template.c
index 14635c25af0..ce45e579db5 100644
--- a/libavfilter/edge_template.c
+++ b/libavfilter/edge_template.c
@@ -74,6 +74,7 @@  void fn(gaussian_blur)(int w, int h,
                        uint8_t *dst, int dst_linesize,
                        const uint8_t *src, int src_linesize, int src_stride)
 {
+    int j;
     pixel *srcp = (pixel *)src;
     pixel *dstp = (pixel *)dst;
 
@@ -81,12 +82,17 @@  void fn(gaussian_blur)(int w, int h,
     src_linesize /= sizeof(pixel);
     dst_linesize /= sizeof(pixel);
 
-    memcpy(dstp, srcp, w*sizeof(pixel)); dstp += dst_linesize; srcp += src_linesize;
-    memcpy(dstp, srcp, w*sizeof(pixel)); dstp += dst_linesize; srcp += src_linesize;
-    for (int j = 2; j < h - 2; j++) {
-        dstp[0] = srcp[(0)*src_stride];
-        dstp[1] = srcp[(1)*src_stride];
-        for (int i = 2; i < w - 2; i++) {
+    for (j = 0; j < FFMIN(h, 2); j++) {
+        memcpy(dstp, srcp, w*sizeof(pixel));
+        dstp += dst_linesize;
+        srcp += src_linesize;
+    }
+
+    for (; j < h - 2; j++) {
+        int i;
+        for (i = 0; i < FFMIN(w, 2); i++)
+            dstp[i] = srcp[i*src_stride];
+        for (; i < w - 2; i++) {
             /* Gaussian mask of size 5x5 with sigma = 1.4 */
             dstp[i] = ((srcp[-2*src_linesize + (i-2)*src_stride] + srcp[2*src_linesize + (i-2)*src_stride]) * 2
                      + (srcp[-2*src_linesize + (i-1)*src_stride] + srcp[2*src_linesize + (i-1)*src_stride]) * 4
@@ -106,12 +112,15 @@  void fn(gaussian_blur)(int w, int h,
                      + srcp[(i+1)*src_stride] * 12
                      + srcp[(i+2)*src_stride] *  5) / 159;
         }
-        dstp[w - 2] = srcp[(w - 2)*src_stride];
-        dstp[w - 1] = srcp[(w - 1)*src_stride];
+        for (; i < w; i++)
+            dstp[i] = srcp[i*src_stride];
 
         dstp += dst_linesize;
         srcp += src_linesize;
     }
-    memcpy(dstp, srcp, w*sizeof(pixel)); dstp += dst_linesize; srcp += src_linesize;
-    memcpy(dstp, srcp, w*sizeof(pixel));
+    for (; j < h; j++) {
+        memcpy(dstp, srcp, w*sizeof(pixel));
+        dstp += dst_linesize;
+        srcp += src_linesize;
+    }
 }