This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit 107072ee9b9cce91cf6ca1f66c04fccd6cfcd77f Author: Michael Niedermayer <[email protected]> AuthorDate: Fri Jul 10 04:07:17 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Sun Aug 2 02:47:28 2026 +0200 avfilter/vf_lut3d: do not compute size*size before the size is validated parse_dat(), parse_cube(), and parse_cinespace() multiply an untrusted LUT size before allocate_3dlut() validates it, which can overflow int. Use the validated lutsize2 computed by allocate_3dlut() instead. Fixes: signed integer overflow (cherry picked from commit 92cd5c97817be98361137e12fdba1f13db20f5c9) Signed-off-by: Michael Niedermayer <[email protected]> --- libavfilter/vf_lut3d.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavfilter/vf_lut3d.c b/libavfilter/vf_lut3d.c index 9071dabeb9..2c78507b7e 100644 --- a/libavfilter/vf_lut3d.c +++ b/libavfilter/vf_lut3d.c @@ -651,11 +651,11 @@ static int parse_dat(AVFilterContext *ctx, FILE *f) NEXT_LINE(skip_line(line)); } - size2 = size * size; ret = allocate_3dlut(ctx, size, 0); if (ret < 0) return ret; + size2 = lut3d->lutsize2; for (k = 0; k < size; k++) { for (j = 0; j < size; j++) { @@ -681,13 +681,13 @@ static int parse_cube(AVFilterContext *ctx, FILE *f) while (fgets(line, sizeof(line), f)) { if (!strncmp(line, "LUT_3D_SIZE", 11)) { - int ret, i, j, k; + int ret, i, j, k, size2; const int size = strtol(line + 12, NULL, 0); - const int size2 = size * size; ret = allocate_3dlut(ctx, size, 0); if (ret < 0) return ret; + size2 = lut3d->lutsize2; for (k = 0; k < size; k++) { for (j = 0; j < size; j++) { @@ -999,7 +999,6 @@ static int parse_cinespace(AVFilterContext *ctx, FILE *f) } size = size_r; - size2 = size * size; if (prelut_sizes[0] && prelut_sizes[1] && prelut_sizes[2]) prelut = 1; @@ -1007,6 +1006,7 @@ static int parse_cinespace(AVFilterContext *ctx, FILE *f) ret = allocate_3dlut(ctx, size, prelut); if (ret < 0) goto end; + size2 = lut3d->lutsize2; for (int k = 0; k < size; k++) { for (int j = 0; j < size; j++) { _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
