RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avfilter/vf_yadif: Fix handing of tiny images 

Fixes: out of array access
Fixes: Ticket8240
Fixes: CVE-2020-22021

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 7971f62120)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2021-05-29 11:17:35 +02:00
parent e6b5c7a5fc
commit 0ab6b4469c
1 changed files with 18 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
libavfilter/vf_yadif.c
View File

@ -123,20 +123,22 @@ static void filter_edges(void *dst1, void *prev1, void *cur1, void *next1,
uint8_t *next2 = parity ? cur : next; uint8_t *next2 = parity ? cur : next;
const int edge = MAX_ALIGN - 1; const int edge = MAX_ALIGN - 1;
int offset = FFMAX(w - edge, 3);
/* Only edge pixels need to be processed here. A constant value of false /* Only edge pixels need to be processed here. A constant value of false
* for is_not_edge should let the compiler ignore the whole branch. */ * for is_not_edge should let the compiler ignore the whole branch. */
FILTER(0, 3, 0) FILTER(0, FFMIN(3, w), 0)
dst = (uint8_t*)dst1 + w - edge; dst = (uint8_t*)dst1 + offset;
prev = (uint8_t*)prev1 + w - edge; prev = (uint8_t*)prev1 + offset;
cur = (uint8_t*)cur1 + w - edge; cur = (uint8_t*)cur1 + offset;
next = (uint8_t*)next1 + w - edge; next = (uint8_t*)next1 + offset;
prev2 = (uint8_t*)(parity ? prev : cur); prev2 = (uint8_t*)(parity ? prev : cur);
next2 = (uint8_t*)(parity ? cur : next); next2 = (uint8_t*)(parity ? cur : next);
FILTER(w - edge, w - 3, 1) FILTER(offset, w - 3, 1)
FILTER(w - 3, w, 0) offset = FFMAX(offset, w - 3);
FILTER(offset, w, 0)
} }
@ -170,21 +172,23 @@ static void filter_edges_16bit(void *dst1, void *prev1, void *cur1, void *next1,
uint16_t *next2 = parity ? cur : next; uint16_t *next2 = parity ? cur : next;
const int edge = MAX_ALIGN / 2 - 1; const int edge = MAX_ALIGN / 2 - 1;
int offset = FFMAX(w - edge, 3);
mrefs /= 2; mrefs /= 2;
prefs /= 2; prefs /= 2;
FILTER(0, 3, 0) FILTER(0, FFMIN(3, w), 0)
dst = (uint16_t*)dst1 + w - edge; dst = (uint16_t*)dst1 + offset;
prev = (uint16_t*)prev1 + w - edge; prev = (uint16_t*)prev1 + offset;
cur = (uint16_t*)cur1 + w - edge; cur = (uint16_t*)cur1 + offset;
next = (uint16_t*)next1 + w - edge; next = (uint16_t*)next1 + offset;
prev2 = (uint16_t*)(parity ? prev : cur); prev2 = (uint16_t*)(parity ? prev : cur);
next2 = (uint16_t*)(parity ? cur : next); next2 = (uint16_t*)(parity ? cur : next);
FILTER(w - edge, w - 3, 1) FILTER(offset, w - 3, 1)
FILTER(w - 3, w, 0) offset = FFMAX(offset, w - 3);
FILTER(offset, w, 0)
} }
static int filter_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) static int filter_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs)