From f703292c421d4193bd87eed646a65d15f83eb884 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 12 Oct 2026 02:25:23 +0200 Subject: [PATCH] avfilter/vf_libopencv: reject shapes too big for OpenCV Fixes: out of array write Fixes: EVA3Y4e693ul Found during the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24753 Out of array write Replicated through UnModified FFmpeg with ASAN --- libavfilter/vf_libopencv.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavfilter/vf_libopencv.c b/libavfilter/vf_libopencv.c index cdfa678860..e34bcb9da7 100644 --- a/libavfilter/vf_libopencv.c +++ b/libavfilter/vf_libopencv.c @@ -240,6 +240,12 @@ static int parse_iplconvkernel(IplConvKernel **kernel, char *buf, void *log_ctx) goto out; } + if (rows > (INT_MAX - sizeof(IplConvKernel) - 32) / sizeof(int) / cols) { + av_log(log_ctx, AV_LOG_ERROR, "Shape size %dx%d is too big\n", cols, rows); + ret = AVERROR(EINVAL); + goto out; + } + if (anchor_x < 0 || anchor_y < 0 || anchor_x >= cols || anchor_y >= rows) { av_log(log_ctx, AV_LOG_ERROR, "Shape anchor %dx%d is not inside the rectangle with size %dx%d.\n",