PR #23574 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23574 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23574.patch
The hand written boundary mirroring reflected an out of range index only once, which is insufficient when the image dimension is smaller than the filter half width (filt_w/2 == 8). A 1x1 input made the index reach 8 and -7, reading out of the src[]/temp[] arrays. Use avpriv_mirror(), which mirrors repeatedly and stays in range for any dimension. Fixes: out of array access Fixes: repro.sh Fixes: HuQn51lLiVJX Fixes: 38aea9b041 (avfilter: add vif filter) Signed-off-by: Michael Niedermayer <[email protected]> >From 7fed25a70c2491eb45ab7b11b61e9c48f6fa4d83 Mon Sep 17 00:00:00 2001 From: Jiale Yao <[email protected]> Date: Tue, 23 Jun 2026 04:15:11 +0200 Subject: [PATCH] avfilter/vf_vif: Fix out of array access with small dimensions The hand written boundary mirroring reflected an out of range index only once, which is insufficient when the image dimension is smaller than the filter half width (filt_w/2 == 8). A 1x1 input made the index reach 8 and -7, reading out of the src[]/temp[] arrays. Use avpriv_mirror(), which mirrors repeatedly and stays in range for any dimension. Fixes: out of array access Fixes: repro.sh Fixes: HuQn51lLiVJX Fixes: 38aea9b041 (avfilter: add vif filter) Signed-off-by: Michael Niedermayer <[email protected]> --- libavfilter/vf_vif.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/libavfilter/vf_vif.c b/libavfilter/vf_vif.c index 64eb39699f..412019a8cf 100644 --- a/libavfilter/vf_vif.c +++ b/libavfilter/vf_vif.c @@ -27,6 +27,7 @@ #include <float.h> +#include "libavutil/internal.h" #include "libavutil/mem.h" #include "libavutil/opt.h" #include "libavutil/pixdesc.h" @@ -238,7 +239,7 @@ static int vif_filter1d(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) int ii = i - filt_w / 2 + filt_i; float img_coeff; - ii = ii < 0 ? -ii : (ii >= h ? 2 * h - ii - 1 : ii); + ii = avpriv_mirror(ii, h - 1); img_coeff = src[ii * src_stride + j]; sum += filt_coeff * img_coeff; @@ -267,7 +268,7 @@ static int vif_filter1d(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) int jj = j - filt_w / 2 + filt_j; float img_coeff; - jj = jj < 0 ? -jj : (jj >= w ? 2 * w - jj - 1 : jj); + jj = avpriv_mirror(jj, w - 1); img_coeff = temp[jj]; sum += filt_coeff * img_coeff; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
