This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit a73d648f6e3e5224dfbee73005a59c2dc161445f Author: Michael Niedermayer <[email protected]> AuthorDate: Sat Jun 27 21:31:23 2026 +0200 Commit: michaelni <[email protected]> CommitDate: Tue Jul 7 17:43:18 2026 +0000 avfilter/vf_v360: keep remap source coordinates in bounds Two runtime paths could compute out-of-range source coordinates for degenerate projection geometry, causing heap-buffer-overflow reads Fixes: out of array read Fixes: assertion failure Signed-off-by: Michael Niedermayer <[email protected]> --- libavfilter/vf_v360.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/libavfilter/vf_v360.c b/libavfilter/vf_v360.c index 6cc3419b07..367c217a79 100644 --- a/libavfilter/vf_v360.c +++ b/libavfilter/vf_v360.c @@ -806,7 +806,7 @@ static inline int ereflectx(int x, int y, int w, int h) static inline int reflectx(int x, int y, int w, int h) { if (y < 0 || y >= h) - return w - 1 - x; + return av_clip(w - 1 - x, 0, w - 1); return mod(x, w); } @@ -1867,9 +1867,14 @@ static int stereographic_to_xyz(const V360Context *s, const float theta = atanf(r) * 2.f; const float sin_theta = sinf(theta); - vec[0] = x / r * sin_theta; - vec[1] = y / r * sin_theta; - vec[2] = cosf(theta); + if (r > 0.f) { + vec[0] = x / r * sin_theta; + vec[1] = y / r * sin_theta; + vec[2] = cosf(theta); + } else { + vec[0] = vec[1] = 0.f; + vec[2] = 1.f; + } return 1; } @@ -1971,9 +1976,14 @@ static int equisolid_to_xyz(const V360Context *s, const float theta = asinf(r) * 2.f; const float sin_theta = sinf(theta); - vec[0] = x / r * sin_theta; - vec[1] = y / r * sin_theta; - vec[2] = cosf(theta); + if (r > 0.f) { + vec[0] = x / r * sin_theta; + vec[1] = y / r * sin_theta; + vec[2] = cosf(theta); + } else { + vec[0] = vec[1] = 0.f; + vec[2] = 1.f; + } return 1; } @@ -4266,6 +4276,10 @@ static int v360_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) out_mask = s->out_transform(s, j, i, height, width, vec); else out_mask = s->out_transform(s, i, j, width, height, vec); + if (!isfinite(vec[0]) || !isfinite(vec[1]) || !isfinite(vec[2])) { + vec[0] = vec[1] = 0.f; + vec[2] = 1.f; + } offset_vector(vec, s->h_offset, s->v_offset); normalize_vector(vec); av_assert1(!isnan(vec[0]) && !isnan(vec[1]) && !isnan(vec[2])); _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
