This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 92cd5c9781 avfilter/vf_lut3d: do not compute size*size before the size
is validated
92cd5c9781 is described below
commit 92cd5c97817be98361137e12fdba1f13db20f5c9
Author: Michael Niedermayer <[email protected]>
AuthorDate: Fri Jul 10 04:07:17 2026 +0200
Commit: michaelni <[email protected]>
CommitDate: Fri Jul 24 19:09:44 2026 +0000
avfilter/vf_lut3d: do not compute size*size before the size is validated
parse_dat(), parse_cube(), and parse_cinespace() multiply an untrusted LUT
size
before allocate_3dlut() validates it, which can overflow int.
Use the validated lutsize2 computed by allocate_3dlut() instead.
Fixes: signed integer overflow
---
libavfilter/vf_lut3d.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/libavfilter/vf_lut3d.c b/libavfilter/vf_lut3d.c
index 9071dabeb9..2c78507b7e 100644
--- a/libavfilter/vf_lut3d.c
+++ b/libavfilter/vf_lut3d.c
@@ -651,11 +651,11 @@ static int parse_dat(AVFilterContext *ctx, FILE *f)
NEXT_LINE(skip_line(line));
}
- size2 = size * size;
ret = allocate_3dlut(ctx, size, 0);
if (ret < 0)
return ret;
+ size2 = lut3d->lutsize2;
for (k = 0; k < size; k++) {
for (j = 0; j < size; j++) {
@@ -681,13 +681,13 @@ static int parse_cube(AVFilterContext *ctx, FILE *f)
while (fgets(line, sizeof(line), f)) {
if (!strncmp(line, "LUT_3D_SIZE", 11)) {
- int ret, i, j, k;
+ int ret, i, j, k, size2;
const int size = strtol(line + 12, NULL, 0);
- const int size2 = size * size;
ret = allocate_3dlut(ctx, size, 0);
if (ret < 0)
return ret;
+ size2 = lut3d->lutsize2;
for (k = 0; k < size; k++) {
for (j = 0; j < size; j++) {
@@ -999,7 +999,6 @@ static int parse_cinespace(AVFilterContext *ctx, FILE *f)
}
size = size_r;
- size2 = size * size;
if (prelut_sizes[0] && prelut_sizes[1] && prelut_sizes[2])
prelut = 1;
@@ -1007,6 +1006,7 @@ static int parse_cinespace(AVFilterContext *ctx, FILE *f)
ret = allocate_3dlut(ctx, size, prelut);
if (ret < 0)
goto end;
+ size2 = lut3d->lutsize2;
for (int k = 0; k < size; k++) {
for (int j = 0; j < size; j++) {
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
