From 339931f548edbada4e14e2ffd32f773ef3ecca47 Mon Sep 17 00:00:00 2001 From: Jiale Yao <19888972804@163.com> Date: Tue, 23 Jun 2026 04:15:11 +0200 Subject: [PATCH] avfilter/vf_vif: Fix out of array access with small dimensions The hand written boundary mirroring reflected an out of range index only once, which is insufficient when the image dimension is smaller than the filter half width (filt_w/2 == 8). A 1x1 input made the index reach 8 and -7, reading out of the src[]/temp[] arrays. Use avpriv_mirror(), which mirrors repeatedly and stays in range for any dimension. Fixes: out of array access Fixes: repro.sh Fixes: HuQn51lLiVJX Fixes: 38aea9b041 (avfilter: add vif filter) Signed-off-by: Michael Niedermayer (cherry picked from commit 56309e476ab385881b15fe52634ba2208bb7f4ba) Signed-off-by: Michael Niedermayer --- libavfilter/vf_vif.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libavfilter/vf_vif.c b/libavfilter/vf_vif.c index 64eb39699f..412019a8cf 100644 --- a/libavfilter/vf_vif.c +++ b/libavfilter/vf_vif.c @@ -27,6 +27,7 @@ #include +#include "libavutil/internal.h" #include "libavutil/mem.h" #include "libavutil/opt.h" #include "libavutil/pixdesc.h" @@ -238,7 +239,7 @@ static int vif_filter1d(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) int ii = i - filt_w / 2 + filt_i; float img_coeff; - ii = ii < 0 ? -ii : (ii >= h ? 2 * h - ii - 1 : ii); + ii = avpriv_mirror(ii, h - 1); img_coeff = src[ii * src_stride + j]; sum += filt_coeff * img_coeff; @@ -267,7 +268,7 @@ static int vif_filter1d(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) int jj = j - filt_w / 2 + filt_j; float img_coeff; - jj = jj < 0 ? -jj : (jj >= w ? 2 * w - jj - 1 : jj); + jj = avpriv_mirror(jj, w - 1); img_coeff = temp[jj]; sum += filt_coeff * img_coeff;