PR #23622 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23622 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23622.patch
>From 83554da19685a99d19bb302e359eabeef5340484 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 27 Jun 2026 21:31:23 +0200 Subject: [PATCH 1/2] avfilter/vf_v360: reject dimensions too small for the projection Fixes: out of array read Fixes: assertion failure Fixes: mQzloVqnivHQ Found-by: Anthony Hurtado Signed-off-by: Michael Niedermayer <[email protected]> --- libavfilter/vf_v360.c | 45 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/libavfilter/vf_v360.c b/libavfilter/vf_v360.c index c502bd5587..d29bcdef62 100644 --- a/libavfilter/vf_v360.c +++ b/libavfilter/vf_v360.c @@ -4309,6 +4309,19 @@ static int get_output_dimension(AVFilterContext *ctx, const char *name, return 0; } +static void projection_min_size(int projection, int *min_w, int *min_h) +{ + switch (projection) { + case CUBEMAP_3_2: *min_w = 3; *min_h = 2; break; + case CUBEMAP_1_6: *min_w = 1; *min_h = 6; break; + case CUBEMAP_6_1: *min_w = 6; *min_h = 1; break; + case BARREL: *min_w = 5; *min_h = 2; break; + case BARREL_SPLIT: *min_w = 3; *min_h = 4; break; + case DUAL_FISHEYE: *min_w = 2; *min_h = 1; break; + default: *min_w = 1; *min_h = 1; break; + } +} + static int config_output(AVFilterLink *outlink) { AVFilterContext *ctx = outlink->src; @@ -4489,6 +4502,22 @@ static int config_output(AVFilterLink *outlink) return AVERROR(EINVAL); } + { + int min_w, min_h; + const int pw = s->in_transpose ? AV_CEIL_RSHIFT(h, desc->log2_chroma_h) + : AV_CEIL_RSHIFT(w, desc->log2_chroma_w); + const int ph = s->in_transpose ? AV_CEIL_RSHIFT(w, desc->log2_chroma_w) + : AV_CEIL_RSHIFT(h, desc->log2_chroma_h); + + projection_min_size(s->in, &min_w, &min_h); + if (pw < min_w || ph < min_h) { + av_log(ctx, AV_LOG_ERROR, + "Input %dx%d is too small for the input projection " + "(requires at least %dx%d per plane).\n", pw, ph, min_w, min_h); + return AVERROR(EINVAL); + } + } + switch (s->in) { case EQUIRECTANGULAR: s->in_transform = xyz_to_equirect; @@ -4876,6 +4905,22 @@ static int config_output(AVFilterLink *outlink) set_dimensions(s->pr_width, s->pr_height, w, h, desc); + { + int min_w, min_h; + const int pw = s->out_transpose ? AV_CEIL_RSHIFT(h, desc->log2_chroma_h) + : AV_CEIL_RSHIFT(w, desc->log2_chroma_w); + const int ph = s->out_transpose ? AV_CEIL_RSHIFT(w, desc->log2_chroma_w) + : AV_CEIL_RSHIFT(h, desc->log2_chroma_h); + + projection_min_size(s->out, &min_w, &min_h); + if (pw < min_w || ph < min_h) { + av_log(ctx, AV_LOG_ERROR, + "Output %dx%d is too small for the output projection " + "(requires at least %dx%d per plane).\n", pw, ph, min_w, min_h); + return AVERROR(EINVAL); + } + } + switch (s->out_stereo) { case STEREO_2D: out_offset_w = out_offset_h = 0; -- 2.52.0 >From cb4ba7187b9843e6af2a30c3192fc200dff3031e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 27 Jun 2026 21:31:23 +0200 Subject: [PATCH 2/2] avfilter/vf_v360: handle non-finite output projection vectors Fixes: assertion failure Signed-off-by: Michael Niedermayer <[email protected]> --- libavfilter/vf_v360.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavfilter/vf_v360.c b/libavfilter/vf_v360.c index d29bcdef62..b581faa0bc 100644 --- a/libavfilter/vf_v360.c +++ b/libavfilter/vf_v360.c @@ -4266,6 +4266,10 @@ static int v360_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) out_mask = s->out_transform(s, j, i, height, width, vec); else out_mask = s->out_transform(s, i, j, width, height, vec); + if (!isfinite(vec[0]) || !isfinite(vec[1]) || !isfinite(vec[2])) { + vec[0] = vec[1] = 0.f; + vec[2] = 1.f; + } offset_vector(vec, s->h_offset, s->v_offset); normalize_vector(vec); av_assert1(!isnan(vec[0]) && !isnan(vec[1]) && !isnan(vec[2])); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
