sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

avfilter/vf_vif: Fix out of array access with small dimensions

Browse Source 
The hand written boundary mirroring reflected an out of range index only
once, which is insufficient when the image dimension is smaller than the
filter half width (filt_w/2 == 8). A 1x1 input made the index reach 8
and -7, reading out of the src[]/temp[] arrays. Use avpriv_mirror(),
which mirrors repeatedly and stays in range for any dimension.

Fixes: out of array access
Fixes: repro.sh
Fixes: HuQn51lLiVJX
Fixes: 38aea9b041 (avfilter: add vif filter)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 56309e476a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Jiale Yao
2026-06-23 04:15:11 +02:00
committed by Michael Niedermayer
parent d1da6bde0c
commit 339931f548
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
libavfilter/vf_vif.c
View File

@@ -27,6 +27,7 @@
#include <float.h>
#include "libavutil/internal.h"
#include "libavutil/mem.h"
#include "libavutil/opt.h"
#include "libavutil/pixdesc.h"
@@ -238,7 +239,7 @@ static int vif_filter1d(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs)
int ii = i - filt_w / 2 + filt_i;
float img_coeff;
ii = ii < 0 ? -ii : (ii >= h ? 2 * h - ii - 1 : ii);
ii = avpriv_mirror(ii, h - 1);
img_coeff = src[ii * src_stride + j];
sum += filt_coeff * img_coeff;
@@ -267,7 +268,7 @@ static int vif_filter1d(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs)
int jj = j - filt_w / 2 + filt_j;
float img_coeff;
jj = jj < 0 ? -jj : (jj >= w ? 2 * w - jj - 1 : jj);
jj = avpriv_mirror(jj, w - 1);
img_coeff = temp[jj];
sum += filt_coeff * img_coeff;