From a342517710690a8f113986e8d8e9d9ffabb701fe Mon Sep 17 00:00:00 2001
From: Stefano Sabatini <stefano.sabatini-lala@poste.it>
Date: Wed, 3 Aug 2011 00:01:41 +0200
Subject: [PATCH] vf_boxblur: fix out-of-buffer access when h > w

Increase size of the private temporary buffers from w to FFMAX(w, h),
indeed they are used also for blurring vertical lines with length h.
---
 libavfilter/vf_boxblur.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavfilter/vf_boxblur.c b/libavfilter/vf_boxblur.c
index 398014a0b9..676d2057cb 100644
--- a/libavfilter/vf_boxblur.c
+++ b/libavfilter/vf_boxblur.c
@@ -144,8 +144,8 @@ static int config_input(AVFilterLink *inlink)
     char *expr;
     int ret;
 
-    if (!(boxblur->temp[0] = av_malloc(w)) ||
-        !(boxblur->temp[1] = av_malloc(w)))
+    if (!(boxblur->temp[0] = av_malloc(FFMAX(w, h))) ||
+        !(boxblur->temp[1] = av_malloc(FFMAX(w, h))))
         return AVERROR(ENOMEM);
 
     boxblur->hsub = desc->log2_chroma_w;