This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/8.0 in repository ffmpeg.
commit 57ba79b21865121e84467b1c2623a8f16832b90b Author: David Korczynski <[email protected]> AuthorDate: Tue May 26 12:00:00 2026 +0000 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Jun 14 04:59:13 2026 +0200 avcodec/agm: validate actual src_y against prev plane in decode_inter_plane Found-by: Anthropic agents; validated and reported by Ada Logics. Signed-off-by: David Korczynski <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 45278542816cab5e8dcb120f9bd62e43ab2857bd) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/agm.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/libavcodec/agm.c b/libavcodec/agm.c index fdf896d61a..92d65db0a9 100644 --- a/libavcodec/agm.c +++ b/libavcodec/agm.c @@ -408,12 +408,14 @@ static int decode_inter_plane(AGMContext *s, GetBitContext *gb, int size, int map = s->map[x]; if (orig_mv_x >= -32) { - if (y * 8 + mv_y < 0 || y * 8 + mv_y + 8 > h || - x * 8 + mv_x < 0 || x * 8 + mv_x + 8 > w) + int src_y = (s->blocks_h - 1 - y) * 8 - mv_y; + int src_x = x * 8 + mv_x; + if (src_y < 0 || src_y + 8 > h || + src_x < 0 || src_x + 8 > w) return AVERROR_INVALIDDATA; copy_block8(frame->data[plane] + (s->blocks_h - 1 - y) * 8 * frame->linesize[plane] + x * 8, - prev->data[plane] + ((s->blocks_h - 1 - y) * 8 - mv_y) * prev->linesize[plane] + (x * 8 + mv_x), + prev->data[plane] + src_y * prev->linesize[plane] + src_x, frame->linesize[plane], prev->linesize[plane], 8); if (map) { s->idsp.idct(s->wblocks + x * 64); @@ -445,12 +447,14 @@ static int decode_inter_plane(AGMContext *s, GetBitContext *gb, int size, return ret; if (orig_mv_x >= -32) { - if (y * 8 + mv_y < 0 || y * 8 + mv_y + 8 > h || - x * 8 + mv_x < 0 || x * 8 + mv_x + 8 > w) + int src_y = (s->blocks_h - 1 - y) * 8 - mv_y; + int src_x = x * 8 + mv_x; + if (src_y < 0 || src_y + 8 > h || + src_x < 0 || src_x + 8 > w) return AVERROR_INVALIDDATA; copy_block8(frame->data[plane] + (s->blocks_h - 1 - y) * 8 * frame->linesize[plane] + x * 8, - prev->data[plane] + ((s->blocks_h - 1 - y) * 8 - mv_y) * prev->linesize[plane] + (x * 8 + mv_x), + prev->data[plane] + src_y * prev->linesize[plane] + src_x, frame->linesize[plane], prev->linesize[plane], 8); if (map) { s->idsp.idct(s->block); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
