PR #24220 opened by yongdev URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24220 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24220.patch
In ff_image_copy_plane_uc_from_x86, FFALIGN(bytewidth, 64) is evaluated directly without validating whether bytewidth or height are non-positive or if bytewidth + 63 causes ptrdiff_t integer overflow. Furthermore, the SSE4 vector copy routines require 16-byte aligned source and destination pointers. Add boundary validation for non-positive dimensions, guard against ptrdiff_t overflow before FFALIGN, and ensure src and dst satisfy 16-byte SSE alignment requirements, returning AVERROR(ENOSYS) to gracefully fall back to the generic C implementation when unaligned. Signed-off-by: yongdev <[email protected]> # Summary of changes Briefly describe what this PR does and why. <!-- If this PR requires new FATE test samples, attach them to the PR and list their target paths below (relative to the fate-suite root). Attached filenames must match the sample's filename: ```fate-samples # e.g. vorbis/new-sample.ogg ``` --> >From 38ce836344f73f140c2923d065ed1dbb65037a72 Mon Sep 17 00:00:00 2001 From: yongdev <[email protected]> Date: Mon, 17 Aug 2026 18:16:50 +0000 Subject: [PATCH] libavutil/x86/imgutils_init: add integer overflow and SSE alignment checks in ff_image_copy_plane_uc_from_x86 In ff_image_copy_plane_uc_from_x86, FFALIGN(bytewidth, 64) is evaluated directly without validating whether bytewidth or height are non-positive or if bytewidth + 63 causes ptrdiff_t integer overflow. Furthermore, the SSE4 vector copy routines require 16-byte aligned source and destination pointers. Add boundary validation for non-positive dimensions, guard against ptrdiff_t overflow before FFALIGN, and ensure src and dst satisfy 16-byte SSE alignment requirements, returning AVERROR(ENOSYS) to gracefully fall back to the generic C implementation when unaligned. Signed-off-by: yongdev <[email protected]> --- libavutil/x86/imgutils_init.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/libavutil/x86/imgutils_init.c b/libavutil/x86/imgutils_init.c index 91a16cf594..f202fe4832 100644 --- a/libavutil/x86/imgutils_init.c +++ b/libavutil/x86/imgutils_init.c @@ -35,7 +35,16 @@ int ff_image_copy_plane_uc_from_x86(uint8_t *dst, ptrdiff_t dst_linesize, ptrdiff_t bytewidth, int height) { int cpu_flags = av_get_cpu_flags(); - ptrdiff_t bw_aligned = FFALIGN(bytewidth, 64); + ptrdiff_t bw_aligned; + + if (bytewidth <= 0 || height <= 0) + return 0; + + if (bytewidth > PTRDIFF_MAX - 63 || + ((uintptr_t)src & 15) != 0 || ((uintptr_t)dst & 15) != 0) + return AVERROR(ENOSYS); + + bw_aligned = FFALIGN(bytewidth, 64); if (EXTERNAL_SSE4(cpu_flags) && bw_aligned <= dst_linesize && bw_aligned <= src_linesize) -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
