From 3fdca8345bcbbe7995a494a2ded42ebe7e577f6f Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 28 Sep 2026 04:18:41 +0000 Subject: [PATCH] avfilter/vf_libopencv: let the shape file alone define the element size For CV_SHAPE_CUSTOM the documentation states that cols and rows from the filter parameters are ignored and the size is taken from the file, but read_shape_from_file() used the caller supplied values as a baseline: *rows was incremented and *cols was raised to the file width. Reset both so that only the file content matters. This also removes two remaining out-of-bounds accesses in the fill loop, which are reachable with a custom shape file whose content is empty or whose last line lacks the terminating newline. Assisted-by: Fairy --- libavfilter/vf_libopencv.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/libavfilter/vf_libopencv.c b/libavfilter/vf_libopencv.c index b8366a00c7..a650a42c77 100644 --- a/libavfilter/vf_libopencv.c +++ b/libavfilter/vf_libopencv.c @@ -136,6 +136,9 @@ static int read_shape_from_file(int *cols, int *rows, int **values, const char * if ((ret = av_file_map(filename, &buf, &size, 0, log_ctx)) < 0) return ret; + /* the file alone defines the size of the shape */ + *cols = *rows = 0; + /* prescan file to get the number of lines and the maximum width */ w = 0; for (i = 0; i < size; i++) {