This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch master
in repository ffmpeg.

The following commit(s) were added to refs/heads/master by this push:
     new c5b5e08eae avfilter/vf_xfade: fix fadegrays reading b's planes with 
a's linesize
c5b5e08eae is described below

commit c5b5e08eae596b3046614fc3b4bfbc169edc9647
Author:     zhang xingxing <[email protected]>
AuthorDate: Mon Sep 21 06:14:36 2026 +0200
Commit:     michaelni <[email protected]>
CommitDate: Mon Sep 21 19:46:21 2026 +0000

    avfilter/vf_xfade: fix fadegrays reading b's planes with a's linesize
    
    Introduced in e13eb58941.
    
    Fixes: out of array access
    Fixes: Oc4Zl8UslbKi
    Reported-identifier: 
swarm-fadegrays-transition-indexes-b-s-planes-with-a-s-linesize-815f04
    Found-by: zhang xingxing <[email protected]>
---
 libavfilter/vf_xfade.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavfilter/vf_xfade.c b/libavfilter/vf_xfade.c
index 53dcf3e1e5..fc1b35ebe4 100644
--- a/libavfilter/vf_xfade.c
+++ b/libavfilter/vf_xfade.c
@@ -1451,14 +1451,14 @@ static void 
fadegrays##name##_transition(AVFilterContext *ctx,
                 const type *yf0 = (const type *)(a->data[0] +                  
      \
                                                  y * a->linesize[0]);          
      \
                 const type *yf1 = (const type *)(b->data[0] +                  
      \
-                                                 y * a->linesize[0]);          
      \
+                                                 y * b->linesize[0]);          
      \
                 bg[0][0] = yf0[x];                                             
      \
                 bg[1][0] = yf1[x];                                             
      \
                 if (s->nb_planes == 4) {                                       
      \
                     const type *af0 = (const type *)(a->data[3] +              
      \
                                                      y * a->linesize[3]);      
      \
                     const type *af1 = (const type *)(b->data[3] +              
      \
-                                                     y * a->linesize[3]);      
      \
+                                                     y * b->linesize[3]);      
      \
                     bg[0][3] = af0[x];                                         
      \
                     bg[1][3] = af1[x];                                         
      \
                 }                                                              
      \

-- 
To stop receiving notification emails like this one, please contact
[email protected].
_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to