sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

swscale/ops_memcpy: do not clear or copy past the last line

Browse Source 
Found during triage of the security report edlOwd4qVGBw.

Fixes: out of array read
Fixes: out of array write
Fixes: negative size memset() / memcpy()
Fixes: orU7yZg5HmsB
Regression since: a151b426f9
Replicated through API
Replicated through UnModified FFmpeg
Signed-off-by: Niklas Haas <git@haasn.dev>
This commit is contained in:
Michael Niedermayer
2026-10-02 06:01:09 +02:00
committed by Niklas Haas
parent f0b1be7b39
commit 6de448b6e7
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
libswscale/ops_memcpy.c
View File

@@ -49,9 +49,11 @@ static void process(const SwsOpExec *exec, const void *priv,
uint8_t *out = exec->out[i];
const int idx = p->index[i];
const int bytes = x_end * exec->block_size_out[i];
const int use_loop = exec->out_stride[i] > bytes + SWS_MAX_PADDING;
const int use_loop = exec->out_stride[i] < 0 ||
exec->out_stride[i] > bytes + SWS_MAX_PADDING;
const size_t span = (size_t) (lines - 1) * exec->out_stride[i] + bytes;
if (idx < 0 && !use_loop) {
memset(out, p->clear_value[i], exec->out_stride[i] * lines);
memset(out, p->clear_value[i], span);
} else if (idx < 0) {
for (int y = y_start; y < y_end; y++) {
memset(out, p->clear_value[i], bytes);
@@ -61,7 +63,7 @@ static void process(const SwsOpExec *exec, const void *priv,
av_assert1(exec->out_stride[i] == exec->in_stride[idx]);
continue; /* plane was already ref'd */
} else if (exec->out_stride[i] == exec->in_stride[idx] && !use_loop) {
memcpy(out, exec->in[idx], exec->out_stride[i] * lines);
memcpy(out, exec->in[idx], span);
} else {
const uint8_t *in = exec->in[idx];
for (int y = y_start; y < y_end; y++) {