This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch master
in repository ffmpeg.

The following commit(s) were added to refs/heads/master by this push:
     new f99df7dbb3 avfilter/vf_find_rect: Fix handling odd sized images
f99df7dbb3 is described below

commit f99df7dbb3043f0b0b1d5de6ce33971645331313
Author:     Michael Niedermayer <[email protected]>
AuthorDate: Wed Jan 7 20:48:34 2026 +0100
Commit:     michaelni <[email protected]>
CommitDate: Mon Jan 12 02:05:11 2026 +0000

    avfilter/vf_find_rect: Fix handling odd sized images
    
    Fixes: out of array read
    Fixes: #YWH-PGM40646-17
    
    Found-by: An0n99X
    Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavfilter/vf_find_rect.c | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/libavfilter/vf_find_rect.c b/libavfilter/vf_find_rect.c
index 037be36fc5..b0be1a6f11 100644
--- a/libavfilter/vf_find_rect.c
+++ b/libavfilter/vf_find_rect.c
@@ -80,8 +80,10 @@ static AVFrame *downscale(AVFrame *in)
     src = in   ->data[0];
     dst = frame->data[0];
 
-    for(y = 0; y < frame->height; y++) {
-        for(x = 0; x < frame->width; x++) {
+    int w2 = in->width/2;
+    int h2 = in->height/2;
+    for(y = 0; y < h2; y++) {
+        for(x = 0; x < w2; x++) {
             dst[x] = (  src[2*x+0]
                       + src[2*x+1]
                       + src[2*x+0 + in->linesize[0]]
@@ -91,6 +93,22 @@ static AVFrame *downscale(AVFrame *in)
         src += 2*in->linesize[0];
         dst += frame->linesize[0];
     }
+    src = in   ->data[0];
+    dst = frame->data[0];
+    for(y = 0; y < frame->height; y++) {
+        int yd = y < h2 ? in->linesize[0] : 0;
+        x = yd ? w2 : 0;
+        for(; x < frame->width; x++) {
+            dst[x] = (  src[2*x+0]
+                      + src[FFMIN(2*x+1, w2)]
+                      + src[2*x+0            + yd]
+                      + src[FFMIN(2*x+1, w2) + yd]
+                      + 2) >> 2;
+        }
+        src += 2*in->linesize[0];
+        dst += frame->linesize[0];
+    }
+
     return frame;
 }
 

_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to