This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 905a432403 libavfilter/showcwt: fix OOB write for DU/RL position init
905a432403 is described below
commit 905a4324030e859a95bbb9901998c55128b7150d
Author: Ruikai Peng <[email protected]>
AuthorDate: Fri Jan 16 22:32:35 2026 -0500
Commit: michaelni <[email protected]>
CommitDate: Sat Jan 24 22:05:34 2026 +0000
libavfilter/showcwt: fix OOB write for DU/RL position init
In config_output() for direction=DU/RL, the position
is initialized to s->sono_size, which equals h or w
when bar=0. That position is later used as an
in-bounds pixel coordinate without clamping in draw(),
causing writes past the end of the output planes.
Repro:
ffmpeg -f lavfi -i sine=frequency=1000:sample_rate=44100 \
-filter_complex "[0:a]showcwt=s=640x512:bar=0:direction=du[v]" \
-map "[v]" -frames:v 1 -f null -
AddressSanitizer: heap-buffer-overflow ... WRITE of size 1
Initialize and wrap the DU/RL position to sono_size - 1
(or 0 when empty), preventing out-of-bounds row/column
writes when bar=0 while preserving existing slide behavior.
---
libavfilter/avf_showcwt.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/libavfilter/avf_showcwt.c b/libavfilter/avf_showcwt.c
index 5cb2e9f9fa..839bdc7983 100644
--- a/libavfilter/avf_showcwt.c
+++ b/libavfilter/avf_showcwt.c
@@ -1012,7 +1012,7 @@ static int config_output(AVFilterLink *outlink)
break;
case DIRECTION_RL:
case DIRECTION_DU:
- s->pos = s->sono_size;
+ s->pos = FFMAX(s->sono_size - 1, 0);
break;
}
@@ -1087,7 +1087,7 @@ static int output_frame(AVFilterContext *ctx)
case DIRECTION_RL:
s->pos--;
if (s->pos < 0) {
- s->pos = s->sono_size;
+ s->pos = FFMAX(s->sono_size - 1, 0);
s->new_frame = 1;
}
break;
@@ -1101,7 +1101,7 @@ static int output_frame(AVFilterContext *ctx)
case DIRECTION_DU:
s->pos--;
if (s->pos < 0) {
- s->pos = s->sono_size;
+ s->pos = FFMAX(s->sono_size - 1, 0);
s->new_frame = 1;
}
break;
@@ -1115,7 +1115,7 @@ static int output_frame(AVFilterContext *ctx)
break;
case DIRECTION_RL:
case DIRECTION_DU:
- s->pos = s->sono_size;
+ s->pos = FFMAX(s->sono_size - 1, 0);
break;
}
break;
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
