diff mbox series

[FFmpeg-devel,3/4] avfilter/vf_gradfun: Do not overread last line

Message ID 20231224232624.30355-3-michael@niedermayer.cc
State Accepted
Commit e4d2666bdc3dbd177a81bbf428654a5f2fa3787a
Headers show
Series [FFmpeg-devel,1/4] avfilter/af_stereowiden: Round length to nearest | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 success Make fate finished
andriy/make_x86 success Make finished
andriy/make_fate_x86 success Make fate finished

Commit Message

Michael Niedermayer Dec. 24, 2023, 11:26 p.m. UTC
The code works in steps of 2 lines and lacks support for odd height
Implementing odd height support is better but for now this fixes the
out of array access

Fixes: out of array access
Fixes: tickets/10702/poc6ffmpe

Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/vf_gradfun.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/libavfilter/vf_gradfun.c b/libavfilter/vf_gradfun.c
index a71a68ecc16..e8d9cae8286 100644
--- a/libavfilter/vf_gradfun.c
+++ b/libavfilter/vf_gradfun.c
@@ -92,7 +92,7 @@  static void filter(GradFunContext *ctx, uint8_t *dst, const uint8_t *src, int wi
     for (y = 0; y < r; y++)
         ctx->blur_line(dc, buf + y * bstride, buf + (y - 1) * bstride, src + 2 * y * src_linesize, src_linesize, width / 2);
     for (;;) {
-        if (y < height - r) {
+        if (y + 1 < height - r) {
             int mod = ((y + r) / 2) % r;
             uint16_t *buf0 = buf + mod * bstride;
             uint16_t *buf1 = buf + (mod ? mod - 1 : r - 1) * bstride;