PR #23088 opened by un-tag URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23088 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23088.patch
The swaprect filter evaluated width and height expressions and used the resulting values to derive copy sizes. Negative dimensions could therefore reach memcpy/memmove as invalid sizes. Reject non-positive rectangle dimensions before deriving plane sizes and add a regression test for the invalid-width case. Fixes: #22866 Reported-by: cxxz16 Signed-off-by: un-tag <[email protected]> >From 39c743c6a25a06335700a591798d7c33d56308ed Mon Sep 17 00:00:00 2001 From: un-tag <[email protected]> Date: Tue, 12 May 2026 19:01:16 -0400 Subject: [PATCH] avfilter/swaprect: reject non-positive rectangle sizes The swaprect filter evaluated width and height expressions and used the resulting values to derive copy sizes. Negative dimensions could therefore reach memcpy/memmove as invalid sizes. Reject non-positive rectangle dimensions before deriving plane sizes and add a regression test for the invalid-width case. Fixes: #22866 Reported-by: cxxz16 Signed-off-by: un-tag <[email protected]> --- libavfilter/vf_swaprect.c | 5 +++++ tests/fate/filter-video.mak | 4 ++++ 2 files changed, 9 insertions(+) diff --git a/libavfilter/vf_swaprect.c b/libavfilter/vf_swaprect.c index 5d93f51c30..0271827872 100644 --- a/libavfilter/vf_swaprect.c +++ b/libavfilter/vf_swaprect.c @@ -138,6 +138,11 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in) if (ret < 0) return ret; + if (!(dw > 0 && dh > 0)) { + av_log(ctx, AV_LOG_ERROR, "Rectangle dimensions must be positive.\n"); + return AVERROR(EINVAL); + } + w = dw; h = dh; x1[0] = dx1; y1[0] = dy1; x2[0] = dx2; y2[0] = dy2; x1[0] = av_clip(x1[0], 0, inlink->w - 1); diff --git a/tests/fate/filter-video.mak b/tests/fate/filter-video.mak index af9c374e1c..fea8295b8f 100644 --- a/tests/fate/filter-video.mak +++ b/tests/fate/filter-video.mak @@ -362,6 +362,10 @@ fate-filter-swaprect: CMD = framecrc -c:v pgmyuv -i $(SRC) -vf swaprect FATE_FILTER_VSYNTH_PGMYUV-$(CONFIG_SWAPRECT_FILTER) += $(FATE_SWAPRECT) +FATE_FILTER-$(call ALLYES, COLOR_FILTER LAVFI_INDEV SWAPRECT_FILTER WRAPPED_AVFRAME_ENCODER NULL_MUXER) += fate-filter-swaprect-invalid-size +fate-filter-swaprect-invalid-size: CMD = ! run $(FFMPEG) -nostdin -hide_banner -f lavfi -i "color=c=black:s=16x16:r=1" -vf "swaprect=w=-1:h=1:x1=0:y1=0:x2=1:y2=0" -frames:v 1 -f null none +fate-filter-swaprect-invalid-size: CMP = null + FATE_FILTER_VSYNTH_PGMYUV-$(CONFIG_TBLEND_FILTER) += fate-filter-tblend fate-filter-tblend: CMD = framecrc -c:v pgmyuv -i $(SRC) -vf tblend=all_mode=difference128 -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
