This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/6.1 in repository ffmpeg.
commit 5431238945f3c20175567a39c11da6ea0426e967 Author: David Korczynski <[email protected]> AuthorDate: Tue May 26 12:00:00 2026 +0000 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Jun 14 20:01:13 2026 +0200 avcodec/agm: validate actual src_y against prev plane in decode_inter_plane Found-by: Anthropic agents; validated and reported by Ada Logics. Signed-off-by: David Korczynski <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 45278542816cab5e8dcb120f9bd62e43ab2857bd) Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit dbfe1e3b662381e33c61df5ee4c527bb5905c141) --- libavcodec/agm.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/libavcodec/agm.c b/libavcodec/agm.c index 88272cc3aa..8eb7137da9 100644 --- a/libavcodec/agm.c +++ b/libavcodec/agm.c @@ -407,12 +407,14 @@ static int decode_inter_plane(AGMContext *s, GetBitContext *gb, int size, int map = s->map[x]; if (orig_mv_x >= -32) { - if (y * 8 + mv_y < 0 || y * 8 + mv_y + 8 > h || - x * 8 + mv_x < 0 || x * 8 + mv_x + 8 > w) + int src_y = (s->blocks_h - 1 - y) * 8 - mv_y; + int src_x = x * 8 + mv_x; + if (src_y < 0 || src_y + 8 > h || + src_x < 0 || src_x + 8 > w) return AVERROR_INVALIDDATA; copy_block8(frame->data[plane] + (s->blocks_h - 1 - y) * 8 * frame->linesize[plane] + x * 8, - prev->data[plane] + ((s->blocks_h - 1 - y) * 8 - mv_y) * prev->linesize[plane] + (x * 8 + mv_x), + prev->data[plane] + src_y * prev->linesize[plane] + src_x, frame->linesize[plane], prev->linesize[plane], 8); if (map) { s->idsp.idct(s->wblocks + x * 64); @@ -444,12 +446,14 @@ static int decode_inter_plane(AGMContext *s, GetBitContext *gb, int size, return ret; if (orig_mv_x >= -32) { - if (y * 8 + mv_y < 0 || y * 8 + mv_y + 8 > h || - x * 8 + mv_x < 0 || x * 8 + mv_x + 8 > w) + int src_y = (s->blocks_h - 1 - y) * 8 - mv_y; + int src_x = x * 8 + mv_x; + if (src_y < 0 || src_y + 8 > h || + src_x < 0 || src_x + 8 > w) return AVERROR_INVALIDDATA; copy_block8(frame->data[plane] + (s->blocks_h - 1 - y) * 8 * frame->linesize[plane] + x * 8, - prev->data[plane] + ((s->blocks_h - 1 - y) * 8 - mv_y) * prev->linesize[plane] + (x * 8 + mv_x), + prev->data[plane] + src_y * prev->linesize[plane] + src_x, frame->linesize[plane], prev->linesize[plane], 8); if (map) { s->idsp.idct(s->block); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
