From 130c6497d2e511d1363cb51ddf68dc9cc2c2f987 Mon Sep 17 00:00:00 2001 From: Stefano Sabatini Date: Fri, 7 Dec 2012 18:51:33 +0100 Subject: [PATCH] lavfi/alphaextract: fix assignment of invalid size value to memcpy in case linesize < 0 Fix crash, for example in the command: ffmpeg -f image2 -vcodec pgmyuv -i tests/vsynth1/%02d.pgm \ -vf "[in]format=yuv420p,split,alphamerge,split[o3][o4]; [o4]vflip,alphaextract[alpha];[o3][alpha]alphamerge[out]" \ -vcodec rawvideo -f nut md5: --- libavfilter/vf_alphaextract.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavfilter/vf_alphaextract.c b/libavfilter/vf_alphaextract.c index 60de6ac2ba..f930c51290 100644 --- a/libavfilter/vf_alphaextract.c +++ b/libavfilter/vf_alphaextract.c @@ -87,7 +87,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *cur_buf) } } } else { - const int linesize = FFMIN(out_buf->linesize[Y], cur_buf->linesize[A]); + const int linesize = abs(FFMIN(out_buf->linesize[Y], cur_buf->linesize[A])); int y; for (y = 0; y < out_buf->video->h; y++) { memcpy(out_buf->data[Y] + y * out_buf->linesize[Y],