From ee25d0d2e0666bef00b05a5713f5852c7deb84c9 Mon Sep 17 00:00:00 2001 From: sfan5 Date: Mon, 24 Jul 2023 21:11:48 +0200 Subject: [PATCH] zimg: fix abort on subsampled input with odd heights We make the assumption that there is more buffer available than indicated, this needs to be considered in this specific location too as mp_image_crop understandably checks whether we're about to do something unsafe. minimal reproducer: mpv av://lavfi:testsrc -vf crop=320:239,format=yuv420p -o test.png fixes #10469 --- video/zimg.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/video/zimg.c b/video/zimg.c index c3560a0ff7..be2953c58c 100644 --- a/video/zimg.c +++ b/video/zimg.c @@ -268,7 +268,14 @@ static bool wrap_buffer(struct mp_zimg_state *st, struct mp_zimg_repack *r, if (r->pack) { mpi = &r->cropped_tmp; *mpi = *a_mpi; - mp_image_crop(mpi, 0, st->slice_y, mpi->w, st->slice_y + st->slice_h); + int y1 = st->slice_y + st->slice_h; + // Due to subsampling we may assume the image to be bigger than it + // actually is (see real_h in setup_format). + if (mpi->h < y1) { + assert(y1 - mpi->h < 4); + mp_image_set_size(mpi, mpi->w, y1); + } + mp_image_crop(mpi, 0, st->slice_y, mpi->w, y1); } bool direct[MP_MAX_PLANES] = {0};