sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-28 15:19:38 +03:00
Code Activity

swscale/ops_memcpy: guard exec->in_stride[-1] access

Browse Source 
When use_loop == true and idx < 0, we would incorrectly check
in_stride[idx], which is OOB read. Reorder conditions to avoid that.

Signed-off-by: Kacper Michajłow <kasper93@gmail.com>
This commit is contained in:
Kacper Michajłow
2026-04-16 19:42:19 +02:00
parent 1764683668
commit 369dbbe488
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libswscale/ops_memcpy.c
View File

@@ -51,13 +51,13 @@ static void process(const SwsOpExec *exec, const void *priv,
const int use_loop = exec->out_stride[i] > bytes + SWS_MAX_PADDING;
if (idx < 0 && !use_loop) {
memset(out, p->clear_value[i], exec->out_stride[i] * lines);
} else if (exec->out_stride[i] == exec->in_stride[idx] && !use_loop) {
memcpy(out, exec->in[idx], exec->out_stride[i] * lines);
} else if (idx < 0) {
for (int y = y_start; y < y_end; y++) {
memset(out, p->clear_value[i], bytes);
out += exec->out_stride[i];
}
} else if (exec->out_stride[i] == exec->in_stride[idx] && !use_loop) {
memcpy(out, exec->in[idx], exec->out_stride[i] * lines);
} else {
const uint8_t *in = exec->in[idx];
for (int y = y_start; y < y_end; y++) {