RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

swscale/rgb2rgb_template: Fix ff_rgb24toyv12_c() with odd height 

Fixes: out of array access
Fixes: 368143798/clusterfuzz-testcase-minimized-ffmpeg_SWS_fuzzer-6475823425585152

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2024-10-09 18:59:19 +02:00
parent 08b1bffa49
commit 14f5d67be3
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libswscale/rgb2rgb_template.c
View File

@ -640,7 +640,7 @@ static inline void uyvytoyv12_c(const uint8_t *src, uint8_t *ydst,
} }
/** /**
* Height should be a multiple of 2 and width should be a multiple of 2. * width should be a multiple of 2.
* (If this is a problem for anyone then tell me, and I will fix it.) * (If this is a problem for anyone then tell me, and I will fix it.)
*/ */
void ff_rgb24toyv12_c(const uint8_t *src, uint8_t *ydst, uint8_t *udst, void ff_rgb24toyv12_c(const uint8_t *src, uint8_t *ydst, uint8_t *udst,
@ -659,6 +659,11 @@ void ff_rgb24toyv12_c(const uint8_t *src, uint8_t *ydst, uint8_t *udst,
for (y = 0; y < height; y += 2) { for (y = 0; y < height; y += 2) {
int i; int i;
if (y + 1 == height) {
ydst2 = ydst1;
src2 = src1;
}
for (i = 0; i < chromWidth; i++) { for (i = 0; i < chromWidth; i++) {
unsigned int b11 = src1[6 * i + 0]; unsigned int b11 = src1[6 * i + 0];
unsigned int g11 = src1[6 * i + 1]; unsigned int g11 = src1[6 * i + 1];