This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/5.1 in repository ffmpeg.
commit 7c0395696726d12fe6f4c5c8ab7bf7a478b27d58 Author: Michael Niedermayer <[email protected]> AuthorDate: Sun Jun 21 01:11:57 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Jun 21 02:56:27 2026 +0200 lavfi/bwdif: fix heap-buffer-overflow with small height videos For frames with height <= 4, filter_intra reads cur[+-3*refs] out of the plane. Route those rows to filter_edge instead. (The fate ref tests this commit touches upstream do not exist in 5.1.) (cherry picked from commit fdfe4d2cfb... adapted to 5.1 vf_bwdif.c) Signed-off-by: Michael Niedermayer <[email protected]> --- libavfilter/vf_bwdif.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/libavfilter/vf_bwdif.c b/libavfilter/vf_bwdif.c index 35c864f71e..868925b932 100644 --- a/libavfilter/vf_bwdif.c +++ b/libavfilter/vf_bwdif.c @@ -232,11 +232,20 @@ static int filter_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) uint8_t *next = &yadif->next->data[td->plane][y * linesize]; uint8_t *dst = &td->frame->data[td->plane][y * td->frame->linesize[td->plane]]; if (yadif->current_field == YADIF_FIELD_END) { - s->filter_intra(dst, cur, td->w, (y + df) < td->h ? refs : -refs, - y > (df - 1) ? -refs : refs, - (y + 3*df) < td->h ? 3 * refs : -refs, - y > (3*df - 1) ? -3 * refs : refs, - td->parity ^ td->tff, clip_max); + if ((y < 3) || ((y + 3) >= td->h)) { + s->filter_edge(dst, prev, cur, next, td->w, + (y + df) < td->h ? refs : -refs, + y > (df - 1) ? -refs : refs, + refs << 1, -(refs << 1), + td->parity ^ td->tff, clip_max, + (y < 2) || ((y + 3) > td->h) ? 0 : 1); + } else { + s->filter_intra(dst, cur, td->w, (y + df) < td->h ? refs : -refs, + y > (df - 1) ? -refs : refs, + (y + 3*df) < td->h ? 3 * refs : -refs, + y > (3*df - 1) ? -3 * refs : refs, + td->parity ^ td->tff, clip_max); + } } else if ((y < 4) || ((y + 5) > td->h)) { s->filter_edge(dst, prev, cur, next, td->w, (y + df) < td->h ? refs : -refs, _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
