This is an automated email from the git hooks/post-receive script. Git pushed a commit to branch master in repository ffmpeg.
commit 6044cf950ab7f436d3b1a5589150aacd2e8e869e Author: romainhedouin <[email protected]> AuthorDate: Fri Oct 16 16:35:47 2026 +0200 Commit: michaelni <[email protected]> CommitDate: Sun Nov 1 04:00:54 2026 +0000 avfilter/vf_nnedi: fix out of bounds reads on narrow planes read_bytes() and read_words() pad each line with 32 mirrored samples on both sides. For a plane narrower than 32 samples they read before the start and past the end of the line. Clamp the indices. The output for wider planes is unchanged. Found with ASan on gray 16x16 and on the chroma of yuv420p 48x32. Found during a code review sweep of ffmpeg using an LLM. Signed-off-by: romainhedouin <[email protected]> --- libavfilter/vf_nnedi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavfilter/vf_nnedi.c b/libavfilter/vf_nnedi.c index 8deba18b0c..5c4b47e0a2 100644 --- a/libavfilter/vf_nnedi.c +++ b/libavfilter/vf_nnedi.c @@ -445,13 +445,13 @@ static void read_bytes(const uint8_t *src, float *dst, { for (int y = 0; y < height; y++) { for (int x = 0; x < 32; x++) - dst[-x - 1] = src[x]; + dst[-x - 1] = src[FFMIN(x, width - 1)]; for (int x = 0; x < width; x++) dst[x] = src[x]; for (int x = 0; x < 32; x++) - dst[width + x] = src[width - x - 1]; + dst[width + x] = src[FFMAX(width - x - 1, 0)]; dst += dst_stride; src += src_stride; @@ -468,13 +468,13 @@ static void read_words(const uint8_t *srcp, float *dst, for (int y = 0; y < height; y++) { for (int x = 0; x < 32; x++) - dst[-x - 1] = src[x] * scale; + dst[-x - 1] = src[FFMIN(x, width - 1)] * scale; for (int x = 0; x < width; x++) dst[x] = src[x] * scale; for (int x = 0; x < 32; x++) - dst[width + x] = src[width - x - 1] * scale; + dst[width + x] = src[FFMAX(width - x - 1, 0)] * scale; dst += dst_stride; src += src_stride; -- To stop receiving notification emails like this one, please contact [email protected]. _______________________________________________ ffmpeg-cvslog mailing list -- [email protected] To unsubscribe send an email to [email protected]
