This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch release/9.0 in repository ffmpeg.
commit f49f5640470b182319fef583be143fc5f82e5d37 Author: Sensei Wa1nut4 <[email protected]> AuthorDate: Sat Sep 5 02:47:35 2026 +0200 Commit: Michael Niedermayer <[email protected]> CommitDate: Thu Sep 17 01:30:42 2026 +0200 swscale/uops: pad the horizontal filter weights to whole blocks Fixes: out of array read Fixes: ffmpeg -i poc_input.ppm -vf scale=17:17:flags=unstable -pix_fmt rgba -f rawvideo - Fixes: sAlT1ubFAGko Found-by: Sensei Wa1nut4 Suggested-by: Niklas Haas <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> (cherry picked from commit 90ba80f81113d4f8e91c68c0f5207a9f6962e906) Signed-off-by: Michael Niedermayer <[email protected]> --- libswscale/uops_tmpl.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/libswscale/uops_tmpl.c b/libswscale/uops_tmpl.c index 214f7a0ef9..06c166f052 100644 --- a/libswscale/uops_tmpl.c +++ b/libswscale/uops_tmpl.c @@ -306,9 +306,25 @@ DECL_SETUP(setup_filter_h, params, out) return AVERROR(ENOTSUP); SwsFilterWeights *filter = params->uop->data.kernel; - out->priv.ptr = av_refstruct_ref(filter->weights); out->priv.i32[2] = filter->filter_size; - out->free = ff_op_priv_unref; + + /* The horizontal filter uop reads weights for a full SWS_BLOCK_SIZE + * outputs per block (see read_planar_fh), so the weights array must be + * padded up to the block-aligned output count. Pad the tail with zero + * weights, which contribute nothing to the accumulated sums. */ + const size_t padded_w = FFALIGN(filter->dst_size, SWS_BLOCK_SIZE); + if (padded_w == filter->dst_size) { + out->priv.ptr = av_refstruct_ref(filter->weights); + out->free = ff_op_priv_unref; + return 0; + } + + int *weights = av_calloc(padded_w * filter->filter_size, sizeof(*weights)); + if (!weights) + return AVERROR(ENOMEM); + memcpy(weights, filter->weights, filter->num_weights * sizeof(*weights)); + out->priv.ptr = weights; + out->free = ff_op_priv_free; return 0; } -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
