sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

swscale: avoid overflow in fast bilinear edge handling

Browse Source 
The final edge clamp computes the source position using int
multiplication before shifting. With sufficiently wide inputs this
overflows, which may suppress the clamp and leave the last output
pixels interpolated with the padding byte.

Promote the multiplication to int64_t in the C, MMXEXT and VSX
implementations.

Add a regression test covering the rightmost pixel of a wide upscale,
which is wrong before this change on both the C and the MMXEXT path.

Fixes: signed integer overflow: 15 * 255918080 cannot be represented in type 'int'
Fixes: #21591
Signed-off-by: iSold Leo <s@qwqlog.com>
(cherry picked from commit ec2a4105e2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
iSold Leo
2026-08-04 14:31:44 +08:00
committed by Michael Niedermayer
parent b2f1a85428
commit e83aa76851
5 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libswscale/hscale_fast_bilinear.c
View File

@@ -31,7 +31,7 @@ void ff_hyscale_fast_c(SwsInternal *c, int16_t *dst, int dstWidth,
dst[i] = (src[xx] << 7) + (src[xx + 1] - src[xx]) * xalpha;
xpos += xInc;
}
for (i=dstWidth-1; (i*xInc)>>16 >=srcW-1; i--)
for (i=dstWidth-1; (i*(int64_t)xInc)>>16 >=srcW-1; i--)
dst[i] = src[srcW-1]*128;
}
@@ -48,7 +48,7 @@ void ff_hcscale_fast_c(SwsInternal *c, int16_t *dst1, int16_t *dst2,
dst2[i] = (src2[xx] * (xalpha ^ 127) + src2[xx + 1] * xalpha);
xpos += xInc;
}
for (i=dstWidth-1; (i*xInc)>>16 >=srcW-1; i--) {
for (i=dstWidth-1; (i*(int64_t)xInc)>>16 >=srcW-1; i--) {
dst1[i] = src1[srcW-1]*128;
dst2[i] = src2[srcW-1]*128;
}

4
libswscale/ppc/swscale_vsx.c
View File

@@ -1754,7 +1754,7 @@ static void hyscale_fast_vsx(SwsInternal *c, int16_t *dst, int dstWidth,
xpos += xInc * 16;
}
for (i=dstWidth-1; (i*xInc)>>16 >=srcW-1; i--)
for (i=dstWidth-1; (i*(int64_t)xInc)>>16 >=srcW-1; i--)
dst[i] = src[srcW-1]*128;
}
@@ -1850,7 +1850,7 @@ static void hcscale_fast_vsx(SwsInternal *c, int16_t *dst1, int16_t *dst2,
xpos += xInc * 16;
}
for (i=dstWidth-1; (i*xInc)>>16 >=srcW-1; i--) {
for (i=dstWidth-1; (i*(int64_t)xInc)>>16 >=srcW-1; i--) {
dst1[i] = src1[srcW-1]*128;
dst2[i] = src2[srcW-1]*128;
}

4
libswscale/x86/hscale_fast_bilinear_simd.c
View File

@@ -275,7 +275,7 @@ void ff_hyscale_fast_mmxext(SwsInternal *c, int16_t *dst,
#endif
);
for (i=dstWidth-1; (i*xInc)>>16 >=srcW-1; i--)
for (i=dstWidth-1; (i*(int64_t)xInc)>>16 >=srcW-1; i--)
dst[i] = src[srcW-1]*128;
}
@@ -352,7 +352,7 @@ void ff_hcscale_fast_mmxext(SwsInternal *c, int16_t *dst1, int16_t *dst2,
#endif
);
for (i=dstWidth-1; (i*xInc)>>16 >=srcW-1; i--) {
for (i=dstWidth-1; (i*(int64_t)xInc)>>16 >=srcW-1; i--) {
dst1[i] = src1[srcW-1]*128;
dst2[i] = src2[srcW-1]*128;
}

3
tests/fate/filter-video.mak
View File

@@ -181,6 +181,9 @@ FATE_FILTER-$(call FILTERFRAMECRC, TESTSRC FORMAT CONCAT SCALE, LAVFI_INDEV FILE
fate-filter-lavd-scalenorm: tests/data/filtergraphs/scalenorm
fate-filter-lavd-scalenorm: CMD = framecrc -f lavfi -graph_file $(TARGET_PATH)/tests/data/filtergraphs/scalenorm -i dummy
FATE_FILTER-$(call FILTERFRAMECRC, COLOR FORMAT SCALE CROP) += fate-filter-scale-fast-bilinear-wide-edge
fate-filter-scale-fast-bilinear-wide-edge: CMD = framecrc -flags bitexact -lavfi color=c=red:s=40000x1:r=1:d=1,format=yuv444p,scale=40032:1:flags=fast_bilinear,crop=1:1:40031:0 -frames:v 1
FATE_FILTER-$(call FILTERFRAMECRC, TESTSRC2 FEEDBACK HFLIP, LAVFI_INDEV) += fate-filter-feedback-hflip
fate-filter-feedback-hflip: CMD = framecrc -f lavfi -i testsrc2=d=1 -vf "[in][hflipin]feedback=x=0:y=0:w=100:h=100[out][hflipout];[hflipout]hflip[hflipin]"

6
tests/ref/fate/filter-scale-fast-bilinear-wide-edge Normal file
View File

@@ -0,0 +1,6 @@
#tb 0: 1/1
#media_type 0: video
#codec_id 0: rawvideo
#dimensions 0: 1x1
#sar 0: 0/1
0, 0, 0, 1, 3, 0x0297019b