From 369dbbe488f526bce8ebb1c3717f61defd8d921b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= Date: Thu, 16 Apr 2026 19:42:19 +0200 Subject: [PATCH] swscale/ops_memcpy: guard exec->in_stride[-1] access MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When use_loop == true and idx < 0, we would incorrectly check in_stride[idx], which is OOB read. Reorder conditions to avoid that. Signed-off-by: Kacper Michajłow --- libswscale/ops_memcpy.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libswscale/ops_memcpy.c b/libswscale/ops_memcpy.c index 4d0477b754..1fec8b21c9 100644 --- a/libswscale/ops_memcpy.c +++ b/libswscale/ops_memcpy.c @@ -51,13 +51,13 @@ static void process(const SwsOpExec *exec, const void *priv, const int use_loop = exec->out_stride[i] > bytes + SWS_MAX_PADDING; if (idx < 0 && !use_loop) { memset(out, p->clear_value[i], exec->out_stride[i] * lines); - } else if (exec->out_stride[i] == exec->in_stride[idx] && !use_loop) { - memcpy(out, exec->in[idx], exec->out_stride[i] * lines); } else if (idx < 0) { for (int y = y_start; y < y_end; y++) { memset(out, p->clear_value[i], bytes); out += exec->out_stride[i]; } + } else if (exec->out_stride[i] == exec->in_stride[idx] && !use_loop) { + memcpy(out, exec->in[idx], exec->out_stride[i] * lines); } else { const uint8_t *in = exec->in[idx]; for (int y = y_start; y < y_end; y++) {