> On Nov 18, 2025, at 09:26, Xiang, Haihao via ffmpeg-devel
> <[email protected]> wrote:
>
> From: Disclosure <[email protected]>
>
> Reviewed-by: Zhong Li <[email protected]>
> Reviewed-by: Haihao Xiang <[email protected]>
> Cc: Michael Niedermayer <[email protected]>
> Signed-off-by: Disclosure <[email protected]>
> ---
> libavcodec/qsv.c | 2 ++
> libavfilter/qsvvpp.c | 2 ++
> libavutil/hwcontext_qsv.c | 20 ++++++++++++++------
> 3 files changed, 18 insertions(+), 6 deletions(-)
>
> diff --git a/libavcodec/qsv.c b/libavcodec/qsv.c
> index cd5195a54b..cc67e2110e 100644
> --- a/libavcodec/qsv.c
> +++ b/libavcodec/qsv.c
> @@ -340,6 +340,8 @@ int ff_qsv_map_frame_to_surface(const AVFrame *frame,
> mfxFrameSurface1 *surface)
> default:
> return AVERROR(ENOSYS);
> }
> + if (frame->linesize[0] <= 0 || frame->linesize[0] > UINT16_MAX)
> + return AVERROR(EINVAL);
linesize[0] < 0 is valid for FFmpeg, although I don’t know whether it can or
should be supported at here.
> surface->Data.PitchLow = frame->linesize[0];
>
> return 0;
> diff --git a/libavfilter/qsvvpp.c b/libavfilter/qsvvpp.c
> index c3685f126c..24e4431f75 100644
> --- a/libavfilter/qsvvpp.c
> +++ b/libavfilter/qsvvpp.c
> @@ -289,6 +289,8 @@ static int map_frame_to_surface(AVFrame *frame,
> mfxFrameSurface1 *surface)
> default:
> return MFX_ERR_UNSUPPORTED;
> }
> + if (frame->linesize[0] <= 0 || frame->linesize[0] > UINT16_MAX)
> + return AVERROR(EINVAL);
> surface->Data.Pitch = frame->linesize[0];
>
> return 0;
> diff --git a/libavutil/hwcontext_qsv.c b/libavutil/hwcontext_qsv.c
> index b92c9cb0ad..7e33d9c1f8 100644
> --- a/libavutil/hwcontext_qsv.c
> +++ b/libavutil/hwcontext_qsv.c
> @@ -1784,6 +1784,8 @@ static int map_frame_to_surface(const AVFrame *frame,
> mfxFrameSurface1 *surface)
> default:
> return MFX_ERR_UNSUPPORTED;
> }
> + if (frame->linesize[0] <= 0 || frame->linesize[0] > UINT16_MAX)
> + return AVERROR(EINVAL);
> surface->Data.Pitch = frame->linesize[0];
> surface->Data.TimeStamp = frame->pts;
>
> @@ -1838,15 +1840,16 @@ static int qsv_transfer_data_from(AVHWFramesContext
> *ctx, AVFrame *dst,
> /* According to MSDK spec for mfxframeinfo, "Width must be a multiple of
> 16.
> * Height must be a multiple of 16 for progressive frame sequence and a
> * multiple of 32 otherwise.", so align all frames to 16 before
> downloading. */
> - if (dst->height & 15 || dst->linesize[0] & 15) {
> + if (dst->height & 15 || dst->linesize[0] & 15 ||
> + dst->linesize[0] <= 0 || dst->linesize[0] > UINT16_MAX) {
> realigned = 1;
> if (tmp_frame->format != dst->format ||
> - tmp_frame->width != FFALIGN(dst->linesize[0], 16) ||
> + tmp_frame->width != FFALIGN(FFABS(dst->linesize[0]), 16) ||
> tmp_frame->height != FFALIGN(dst->height, 16)) {
> av_frame_unref(tmp_frame);
>
> tmp_frame->format = dst->format;
> - tmp_frame->width = FFALIGN(dst->linesize[0], 16);
> + tmp_frame->width = FFALIGN(FFABS(dst->linesize[0]), 16);
> tmp_frame->height = FFALIGN(dst->height, 16);
> ret = av_frame_get_buffer(tmp_frame, 0);
> if (ret < 0)
> @@ -1865,7 +1868,9 @@ static int qsv_transfer_data_from(AVHWFramesContext
> *ctx, AVFrame *dst,
> }
>
> out.Info = in->Info;
> - map_frame_to_surface(dst_frame, &out);
> + ret = map_frame_to_surface(dst_frame, &out);
> + if (ret < 0)
> + return ret;
>
> do {
> err = MFXVideoVPP_RunFrameVPPAsync(s->session_download, in, &out,
> NULL, &sync);
> @@ -1922,7 +1927,8 @@ static int qsv_transfer_data_to(AVHWFramesContext *ctx,
> AVFrame *dst,
> /* According to MSDK spec for mfxframeinfo, "Width must be a multiple of
> 16.
> * Height must be a multiple of 16 for progressive frame sequence and a
> * multiple of 32 otherwise.", so align all frames to 16 before
> uploading. */
> - if (src->height & 15 || src->linesize[0] & 15) {
> + if (src->height & 15 || src->linesize[0] & 15 ||
> + src->linesize[0] <= 0 || src->linesize[0] > UINT16_MAX) {
> realigned = 1;
> if (tmp_frame->format != src->format ||
> tmp_frame->width != FFALIGN(src->width, 16) ||
> @@ -1963,7 +1969,9 @@ static int qsv_transfer_data_to(AVHWFramesContext *ctx,
> AVFrame *dst,
> }
>
> in.Info = out->Info;
> - map_frame_to_surface(src_frame, &in);
> + ret = map_frame_to_surface(src_frame, &in);
> + if (ret < 0)
> + return ret;
>
> do {
> err = MFXVideoVPP_RunFrameVPPAsync(s->session_upload, &in, out, NULL,
> &sync);
> --
> 2.43.0
>
> _______________________________________________
> ffmpeg-devel mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
