This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit eccf4fadf1e70c477433c76267fdcb36400982d2 Author: zhang xingxing <[email protected]> AuthorDate: Thu Oct 15 03:53:08 2026 +0200 Commit: michaelni <[email protected]> CommitDate: Mon Oct 19 23:51:00 2026 +0000 avfilter/vf_avgblur: compute max * area in 64bit Fixes: out of array read Fixes: BxsBdfl8050I Fixes: swarm-Signed-integer-overflow-in-build_lut-slow-check-enables-heap-OOB-read-ba3309 Regression since: a7fc78c1a6 Out of array read Replicated through UnModified FFmpeg with ASAN Found-by: zhang xingxing <[email protected]> Signed-off-by: Michael Niedermayer <[email protected]> --- libavfilter/vf_avgblur.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavfilter/vf_avgblur.c b/libavfilter/vf_avgblur.c index 3bd4faa5f6..66c046471e 100644 --- a/libavfilter/vf_avgblur.c +++ b/libavfilter/vf_avgblur.c @@ -174,7 +174,7 @@ static void build_lut(AVFilterContext *ctx, int max) const int area = (2 * s->radiusV + 1) * (2 * s->radius + 1); s->area = area; - if (max * area >= FF_ARRAY_ELEMS(s->lut)) + if ((int64_t)max * area >= FF_ARRAY_ELEMS(s->lut)) return; for (int i = 0, j = 0, k = 0; i < max * area; i++, j++) { @@ -234,7 +234,7 @@ static void averageiir2d(AVFilterContext *ctx, AVFrame *in, AVFrame *out, int pl AverageBlurContext *s = ctx->priv; const int width = s->planewidth[plane]; const int height = s->planeheight[plane]; - const int slow = (s->max * s->area) >= FF_ARRAY_ELEMS(s->lut); + const int slow = ((int64_t)s->max * s->area) >= FF_ARRAY_ELEMS(s->lut); ThreadData td; td.width = width; -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
