This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/6.1 in repository ffmpeg.
commit 04bc39441dd2921440c7dbf5a7db7549306b94f5 Author: Bogdan Lisman <[email protected]> AuthorDate: Mon Jun 15 04:07:59 2026 +0300 Commit: Michael Niedermayer <[email protected]> CommitDate: Wed Jun 17 01:34:13 2026 +0200 avcodec/snowenc: fix out-of-bounds memcpy in get_block_rd() for narrow planes For an edge block, get_block_rd() copies the full-OBMC-weight central region directly from cur[] into the reconstruction. It moved one boundary to block_w/block_h but overwrote the in-plane clip (x0/x1/y0/y1 computed earlier from the plane size) instead of intersecting with it. When a plane is narrower than block_w - e.g. a tiny field/chroma plane produced by the mcdeint filter - the right-edge case left x0 = block_w while x1 stayed clipped to w - sx < block_w, so x1 - x0 became negative and was passed to memcpy() as a huge size_t, crashing with SIGSEGV. Intersect the moved boundaries with the existing clip so the copy region stays inside the plane and the memcpy length can never be negative. Reproducible with the GPL mcdeint filter in slow/extra_slow mode, e.g. ffmpeg -f lavfi -i testsrc=s=5x32 -vf mcdeint=mode=slow -f null - This is a separate crash from the get_dc() SIGFPE (ticket #7779) reached through the same iterative_me() path. Add a lavfi-based FATE regression test. Signed-off-by: Bogdan Lisman <[email protected]> (cherry picked from commit 11684476268e5c518f70e9e120f4fc6ed58ff3ef) Signed-off-by: Michael Niedermayer <[email protected]> --- libavcodec/snowenc.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/libavcodec/snowenc.c b/libavcodec/snowenc.c index f43c45705a..69b5c663f0 100644 --- a/libavcodec/snowenc.c +++ b/libavcodec/snowenc.c @@ -814,13 +814,14 @@ static int get_block_rd(SnowEncContext *enc, int mb_x, int mb_y, && (mb_x == 0 || mb_x == b_stride-1) && (mb_y == 0 || mb_y == b_height-1)){ if(mb_x == 0) - x1 = block_w; + x1 = FFMIN(x1, block_w); else - x0 = block_w; + x0 = FFMAX(x0, block_w); if(mb_y == 0) - y1 = block_h; + y1 = FFMIN(y1, block_h); else - y0 = block_h; + y0 = FFMAX(y0, block_h); + x0 = FFMIN(x0, x1); for(y=y0; y<y1; y++) memcpy(dst + sx+x0 + (sy+y)*ref_stride, cur + x0 + y*ref_stride, x1-x0); } _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
