PR #21409 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21409 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21409.patch
Fixes: out of array read Fixes: #YWH-PGM40646-17 Found-by: An0n99X Signed-off-by: Michael Niedermayer <[email protected]> >From 6a0822317a3e60c9c8611dc47bc1ea09c89d0657 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Wed, 7 Jan 2026 20:48:34 +0100 Subject: [PATCH] avfilter/vf_find_rect: Fix handling odd sized images Fixes: out of array read Fixes: #YWH-PGM40646-17 Found-by: An0n99X Signed-off-by: Michael Niedermayer <[email protected]> --- libavfilter/vf_find_rect.c | 22 ++++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/libavfilter/vf_find_rect.c b/libavfilter/vf_find_rect.c index 037be36fc5..b0be1a6f11 100644 --- a/libavfilter/vf_find_rect.c +++ b/libavfilter/vf_find_rect.c @@ -80,8 +80,10 @@ static AVFrame *downscale(AVFrame *in) src = in ->data[0]; dst = frame->data[0]; - for(y = 0; y < frame->height; y++) { - for(x = 0; x < frame->width; x++) { + int w2 = in->width/2; + int h2 = in->height/2; + for(y = 0; y < h2; y++) { + for(x = 0; x < w2; x++) { dst[x] = ( src[2*x+0] + src[2*x+1] + src[2*x+0 + in->linesize[0]] @@ -91,6 +93,22 @@ static AVFrame *downscale(AVFrame *in) src += 2*in->linesize[0]; dst += frame->linesize[0]; } + src = in ->data[0]; + dst = frame->data[0]; + for(y = 0; y < frame->height; y++) { + int yd = y < h2 ? in->linesize[0] : 0; + x = yd ? w2 : 0; + for(; x < frame->width; x++) { + dst[x] = ( src[2*x+0] + + src[FFMIN(2*x+1, w2)] + + src[2*x+0 + yd] + + src[FFMIN(2*x+1, w2) + yd] + + 2) >> 2; + } + src += 2*in->linesize[0]; + dst += frame->linesize[0]; + } + return frame; } -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
