diff --git a/libavfilter/vf_libopencv.c b/libavfilter/vf_libopencv.c index cdfa678860..e34bcb9da7 100644 --- a/libavfilter/vf_libopencv.c +++ b/libavfilter/vf_libopencv.c @@ -240,6 +240,12 @@ static int parse_iplconvkernel(IplConvKernel **kernel, char *buf, void *log_ctx) goto out; } + if (rows > (INT_MAX - sizeof(IplConvKernel) - 32) / sizeof(int) / cols) { + av_log(log_ctx, AV_LOG_ERROR, "Shape size %dx%d is too big\n", cols, rows); + ret = AVERROR(EINVAL); + goto out; + } + if (anchor_x < 0 || anchor_y < 0 || anchor_x >= cols || anchor_y >= rows) { av_log(log_ctx, AV_LOG_ERROR, "Shape anchor %dx%d is not inside the rectangle with size %dx%d.\n",