From f0b1be7b3903165eda7b2500f9dd43cf344da2e1 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 2 Oct 2026 03:25:33 +0200 Subject: [PATCH] swscale/graph: do not copy past the last line in run_copy() Use ff_copyPlane() with the width of the line. It still copies equal positive linesizes as one block, but ends it with the last line. Found during triage of the security report edlOwd4qVGBw. Fixes: out of array read Fixes: out of array write Fixes: negative size memcpy() Fixes: xvstjaVdxtut Regression since: bf738412e8 Replicated through API --- This also fixes copying negative linesizes. Signed-off-by: Niklas Haas --- libswscale/graph.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/libswscale/graph.c b/libswscale/graph.c index a980af1ee1..cc8e5cf7a2 100644 --- a/libswscale/graph.c +++ b/libswscale/graph.c @@ -298,15 +298,10 @@ static void run_copy(const SwsFrame *out, const SwsFrame *in, int y, int h, if (in_data[i] == out_data[i]) { av_assert0(in->linesize[i] == out->linesize[i]); - } else if (in->linesize[i] == out->linesize[i]) { - memcpy(out_data[i], in_data[i], lines * out->linesize[i]); } else { - const int linesize = FFMIN(out->linesize[i], in->linesize[i]); - for (int j = 0; j < lines; j++) { - memcpy(out_data[i], in_data[i], linesize); - in_data[i] += in->linesize[i]; - out_data[i] += out->linesize[i]; - } + ff_copyPlane(in_data[i], in->linesize[i], 0, lines, + av_image_get_linesize(out->format, out->width, i), + out_data[i], out->linesize[i]); } } }