This is an automated email from the git hooks/post-receive script.
Git pushed a commit to branch master
in repository ffmpeg.
The following commit(s) were added to refs/heads/master by this push:
new 884590dd4a libswscale/ppc/yuv2rgb_altivec: Fix heap buffer overflow in
yuv2packedX
884590dd4a is described below
commit 884590dd4aad5fcc7a91fbbb7af8a5da80b61d96
Author: Hao Chen <[email protected]>
AuthorDate: Tue Aug 18 00:26:47 2026 +0000
Commit: Niklas Haas <[email protected]>
CommitDate: Sat Sep 12 10:48:45 2026 +0000
libswscale/ppc/yuv2rgb_altivec: Fix heap buffer overflow in yuv2packedX
Process only complete 16-pixel blocks directly into the destination.
This makes the previously unreachable scratch-buffer tail handle the
remaining pixels. Remove its rewind and use the destination pixel stride
for both the copy offset and length.
Signed-off-by: Hao Chen <[email protected]>
---
libswscale/ppc/yuv2rgb_altivec.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/libswscale/ppc/yuv2rgb_altivec.c b/libswscale/ppc/yuv2rgb_altivec.c
index cad3f8d7c0..1038896ca7 100644
--- a/libswscale/ppc/yuv2rgb_altivec.c
+++ b/libswscale/ppc/yuv2rgb_altivec.c
@@ -705,7 +705,7 @@ static av_always_inline void
yuv2packedX_altivec(SwsInternal *c,
out = (vector unsigned char *) dest;
- for (i = 0; i < dstW; i += 16) {
+ for (i = 0; i < dstW - 15; i += 16) {
Y0 = RND;
Y1 = RND;
/* extract 16 coeffs from lumSrc */
@@ -795,8 +795,6 @@ static av_always_inline void
yuv2packedX_altivec(SwsInternal *c,
}
if (i < dstW) {
- i -= 16;
-
Y0 = RND;
Y1 = RND;
/* extract 16 coeffs from lumSrc */
@@ -878,7 +876,8 @@ static av_always_inline void
yuv2packedX_altivec(SwsInternal *c,
return;
}
- memcpy(&((uint32_t *) dest)[i], scratch, (dstW - i) / 4);
+ int pixel_stride = av_pix_fmt_desc_get(target)->comp[0].step;
+ memcpy(&dest[i * pixel_stride], scratch, (dstW - i) * pixel_stride);
}
}
--
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]
