sysutils/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-10-24 02:09:03 +03:00
Code Activity

swscale/graph: do not copy past the last line in run_copy()

Browse Source 
Use ff_copyPlane() with the width of the line. It still copies equal
positive linesizes as one block, but ends it with the last line.

Found during triage of the security report edlOwd4qVGBw.

Fixes: out of array read
Fixes: out of array write
Fixes: negative size memcpy()
Fixes: xvstjaVdxtut
Regression since: bf738412e8
Replicated through API

---

This also fixes copying negative linesizes.

Signed-off-by: Niklas Haas <git@haasn.dev>
This commit is contained in:
Michael Niedermayer
2026-10-02 03:25:33 +02:00
committed by Niklas Haas
parent 65c0ef88a5
commit f0b1be7b39
1 changed files with 3 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
libswscale/graph.c
View File

@@ -298,15 +298,10 @@ static void run_copy(const SwsFrame *out, const SwsFrame *in, int y, int h,
if (in_data[i] == out_data[i]) {
av_assert0(in->linesize[i] == out->linesize[i]);
} else if (in->linesize[i] == out->linesize[i]) {
memcpy(out_data[i], in_data[i], lines * out->linesize[i]);
} else {
const int linesize = FFMIN(out->linesize[i], in->linesize[i]);
for (int j = 0; j < lines; j++) {
memcpy(out_data[i], in_data[i], linesize);
in_data[i] += in->linesize[i];
out_data[i] += out->linesize[i];
}
ff_copyPlane(in_data[i], in->linesize[i], 0, lines,
av_image_get_linesize(out->format, out->width, i),
out_data[i], out->linesize[i]);
}
}
}