This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch master
in repository ffmpeg.

commit 795bb37a39e163cbb5b6d897ebb0ca90ea7b449a
Author:     Michael Niedermayer <[email protected]>
AuthorDate: Wed Jan 21 01:38:42 2026 +0100
Commit:     michaelni <[email protected]>
CommitDate: Fri Jan 23 17:53:33 2026 +0000

    swscale/utils: Avoid FF_ALLOC_TYPED_ARRAY() and use av_malloc_array() 
directly
    
    Fixes: multiple integer overflows
    Fixes: out of array access
    
    Regression since: a408d03ee6eeda98e77301dcdea3bdf40c0d4afc
    
    The PoC modifies filter parameters generally inaccessable to an attacker
    
    Found-by: Zhenpeng (Leo) Lin from depthfirst
    Signed-off-by: Michael Niedermayer <[email protected]>
---
 libswscale/utils.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/libswscale/utils.c b/libswscale/utils.c
index 8f8789b24d..394a683696 100644
--- a/libswscale/utils.c
+++ b/libswscale/utils.c
@@ -103,7 +103,8 @@ int ff_shuffle_filter_coefficients(SwsInternal *c, int 
*filterPos,
         if ((c->srcBpc == 8) && (c->dstBpc <= 14)) {
            int16_t *filterCopy = NULL;
            if (filterSize > 4) {
-               if (!FF_ALLOC_TYPED_ARRAY(filterCopy, dstW * filterSize))
+               filterCopy = av_malloc_array(dstW, filterSize * 
sizeof(*filterCopy));
+               if (!filterCopy)
                    return AVERROR(ENOMEM);
                memcpy(filterCopy, filter, dstW * filterSize * sizeof(int16_t));
            }
@@ -282,7 +283,8 @@ static av_cold int initFilter(int16_t **outFilter, int32_t 
**filterPos,
         filterSize = FFMIN(filterSize, srcW - 2);
         filterSize = FFMAX(filterSize, 1);
 
-        if (!FF_ALLOC_TYPED_ARRAY(filter, dstW * filterSize))
+        filter = av_malloc_array(dstW, filterSize * sizeof(*filter));
+        if (!filter)
             goto nomem;
         xDstInSrc = ((dstPos*(int64_t)xInc)>>7) - ((srcPos*0x10000LL)>>7);
         for (i = 0; i < dstW; i++) {
@@ -381,7 +383,8 @@ static av_cold int initFilter(int16_t **outFilter, int32_t 
**filterPos,
     if (dstFilter)
         filter2Size += dstFilter->length - 1;
     av_assert0(filter2Size > 0);
-    if (!FF_ALLOCZ_TYPED_ARRAY(filter2, dstW * filter2Size))
+    filter2 = av_malloc_array(dstW, filter2Size * sizeof(*filter2));
+    if (!filter2)
         goto nomem;
     for (i = 0; i < dstW; i++) {
         int j, k;
@@ -549,7 +552,8 @@ static av_cold int initFilter(int16_t **outFilter, int32_t 
**filterPos,
 
     // Note the +1 is for the MMX scaler which reads over the end
     /* align at 16 for AltiVec (needed by hScale_altivec_real) */
-    if (!FF_ALLOCZ_TYPED_ARRAY(*outFilter, *outFilterSize * (dstW + 3)))
+    *outFilter = av_malloc_array(dstW + 3, *outFilterSize * 
sizeof(**outFilter));
+    if (!*outFilter)
         goto nomem;
 
     /* normalize & store in outFilter */
@@ -1716,8 +1720,9 @@ av_cold int ff_sws_init_single_context(SwsContext *sws, 
SwsFilter *srcFilter,
             goto fail;
 
 #if HAVE_ALTIVEC
-        if (!FF_ALLOC_TYPED_ARRAY(c->vYCoeffsBank, c->vLumFilterSize * 
sws->dst_h) ||
-            !FF_ALLOC_TYPED_ARRAY(c->vCCoeffsBank, c->vChrFilterSize * 
c->chrDstH))
+        c->vYCoeffsBank = av_malloc_array(sws->dst_h, c->vLumFilterSize * 
sizeof(*c->vYCoeffsBank));
+        c->vCCoeffsBank = av_malloc_array(c->chrDstH, c->vChrFilterSize * 
sizeof(*c->vCCoeffsBank));
+        if (c->vYCoeffsBank == NULL || c->vCCoeffsBank == NULL)
             goto nomem;
 
         for (i = 0; i < c->vLumFilterSize * sws->dst_h; i++) {

_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to