PR #21498 opened by ruikai URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21498 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21498.patch
In config_output() for direction=DU/RL, the position is initialized to s->sono_size, which equals h or w when bar=0. That position is later used as an in-bounds pixel coordinate without clamping in draw(), causing writes past the end of the output planes. Repro: ``` ffmpeg -f lavfi -i sine=frequency=1000:sample_rate=44100 \ -filter_complex "[0:a]showcwt=s=640x512:bar=0:direction=du[v]" \ -map "[v]" -frames:v 1 -f null - ``` AddressSanitizer: `heap-buffer-overflow ... WRITE of size 1` Initialize and wrap the DU/RL position to sono_size - 1 (or 0 when empty), preventing out-of-bounds row/column writes when bar=0 while preserving existing slide behavior. >From 933c5c48cfa9cd66fd655beb123c3fee1b18ddac Mon Sep 17 00:00:00 2001 From: Ruikai Peng <[email protected]> Date: Fri, 16 Jan 2026 22:32:35 -0500 Subject: [PATCH] libavfilter/showcwt: fix OOB write for DU/RL position init In config_output() for direction=DU/RL, the position is initialized to s->sono_size, which equals h or w when bar=0. That position is later used as an in-bounds pixel coordinate without clamping in draw(), causing writes past the end of the output planes. Repro: ffmpeg -f lavfi -i sine=frequency=1000:sample_rate=44100 \ -filter_complex "[0:a]showcwt=s=640x512:bar=0:direction=du[v]" \ -map "[v]" -frames:v 1 -f null - AddressSanitizer: heap-buffer-overflow ... WRITE of size 1 Initialize and wrap the DU/RL position to sono_size - 1 (or 0 when empty), preventing out-of-bounds row/column writes when bar=0 while preserving existing slide behavior. --- libavfilter/avf_showcwt.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavfilter/avf_showcwt.c b/libavfilter/avf_showcwt.c index 8edf2fb43b..37cbf5514b 100644 --- a/libavfilter/avf_showcwt.c +++ b/libavfilter/avf_showcwt.c @@ -1012,7 +1012,7 @@ static int config_output(AVFilterLink *outlink) break; case DIRECTION_RL: case DIRECTION_DU: - s->pos = s->sono_size; + s->pos = FFMAX(s->sono_size - 1, 0); break; } @@ -1087,7 +1087,7 @@ static int output_frame(AVFilterContext *ctx) case DIRECTION_RL: s->pos--; if (s->pos < 0) { - s->pos = s->sono_size; + s->pos = FFMAX(s->sono_size - 1, 0); s->new_frame = 1; } break; @@ -1101,7 +1101,7 @@ static int output_frame(AVFilterContext *ctx) case DIRECTION_DU: s->pos--; if (s->pos < 0) { - s->pos = s->sono_size; + s->pos = FFMAX(s->sono_size - 1, 0); s->new_frame = 1; } break; @@ -1115,7 +1115,7 @@ static int output_frame(AVFilterContext *ctx) break; case DIRECTION_RL: case DIRECTION_DU: - s->pos = s->sono_size; + s->pos = FFMAX(s->sono_size - 1, 0); break; } break; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
