RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-14 19:25:01 +00:00
Code Issues Projects Releases Wiki Activity

avfilter/vf_scale: fix off-by-one in loop bounds

Browse Source 
Results in over-read of the array. Fortunately, the excess element was
never actually used, but it still triggers ASAN (and could in theory trigger
a segfault).

Fixes: 04ce01df0b
This commit is contained in:
Niklas Haas 2024-11-25 14:27:38 +01:00
parent 3c3bf6c109
commit bcbf3a5630
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavfilter/vf_scale.c
View File

@ -482,7 +482,7 @@ static int query_formats(const AVFilterContext *ctx,
formats = ff_all_color_spaces();
for (int i = 0; i < formats->nb_formats; i++) {
if (!sws_test_colorspace(formats->formats[i], 0)) {
for (int j = i--; j < formats->nb_formats; j++)
for (int j = i--; j + 1 < formats->nb_formats; j++)
formats->formats[j] = formats->formats[j + 1];
formats->nb_formats--;
}
@ -501,7 +501,7 @@ static int query_formats(const AVFilterContext *ctx,
formats = ff_all_color_spaces();
for (int i = 0; i < formats->nb_formats; i++) {
if (!sws_test_colorspace(formats->formats[i], 1)) {
for (int j = i--; j < formats->nb_formats; j++)
for (int j = i--; j + 1 < formats->nb_formats; j++)
formats->formats[j] = formats->formats[j + 1];
formats->nb_formats--;
}