PR #24472 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24472 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24472.patch
Fixes: signed integer overflow: 2147385240 + 131098 cannot be represented in type 'int' Fixes: out of array read Fixes: p2bTyZBk48yf Found-by: DarrenC >From 1a3fc0d5fc6e52eb48d5a8685f204254874643e3 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 13 Sep 2026 02:21:45 +0200 Subject: [PATCH 1/3] swscale: leave sources 65536 pixels and wider to the bilinear scaler Fixes: signed integer overflow: 2147385240 + 131098 cannot be represented in type 'int' Fixes: out of array read Fixes: p2bTyZBk48yf Found-by: DarrenC --- libswscale/utils.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/libswscale/utils.c b/libswscale/utils.c index 59b6776f6a..5004f28933 100644 --- a/libswscale/utils.c +++ b/libswscale/utils.c @@ -1222,7 +1222,8 @@ av_cold int ff_sws_init_single_context(SwsContext *sws, SwsFilter *srcFilter, } if (i == SWS_FAST_BILINEAR) { - if (srcW < 8 || dstW <= 8) { + /* the fast bilinear scalers keep the source position in 16.16 fixed point */ + if (srcW < 8 || dstW <= 8 || srcW >= 65536) { i = SWS_BILINEAR; flags ^= SWS_FAST_BILINEAR | i; sws->flags = flags; -- 2.52.0 >From 01742da7e78f1a7d40576e658d8df8a212798141 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 13 Sep 2026 03:35:30 +0200 Subject: [PATCH 2/3] tests/fate: scale a 300000 pixel wide gradient with the fast bilinear scaler --- tests/fate/filter-video.mak | 3 +++ tests/ref/fate/filter-scale-fast-bilinear-wide-wrap | 6 ++++++ 2 files changed, 9 insertions(+) create mode 100644 tests/ref/fate/filter-scale-fast-bilinear-wide-wrap diff --git a/tests/fate/filter-video.mak b/tests/fate/filter-video.mak index 36e3553d05..411f9d04f3 100644 --- a/tests/fate/filter-video.mak +++ b/tests/fate/filter-video.mak @@ -184,6 +184,9 @@ fate-filter-lavd-scalenorm: CMD = framecrc -f lavfi -graph_file $(TARGET_PATH)/t FATE_FILTER-$(call FILTERFRAMECRC, COLOR FORMAT SCALE CROP) += fate-filter-scale-fast-bilinear-wide-edge fate-filter-scale-fast-bilinear-wide-edge: CMD = framecrc -flags bitexact -lavfi color=c=red:s=40000x1:r=1:d=1,format=yuv444p,scale=40032:1:flags=fast_bilinear,crop=1:1:40031:0 -frames:v 1 +FATE_FILTER-$(call FILTERFRAMECRC, NULLSRC GEQ FORMAT SCALE CROP) += fate-filter-scale-fast-bilinear-wide-wrap +fate-filter-scale-fast-bilinear-wide-wrap: CMD = framecrc -flags bitexact -lavfi 'nullsrc=s=300000x1,geq=lum=X*255/W:cb=128:cr=128,format=gray,scale=300032:1:flags=fast_bilinear,crop=1:1:279000:0' -frames:v 1 + FATE_FILTER-$(call FILTERFRAMECRC, TESTSRC2 FEEDBACK HFLIP, LAVFI_INDEV) += fate-filter-feedback-hflip fate-filter-feedback-hflip: CMD = framecrc -f lavfi -i testsrc2=d=1 -vf "[in][hflipin]feedback=x=0:y=0:w=100:h=100[out][hflipout];[hflipout]hflip[hflipin]" diff --git a/tests/ref/fate/filter-scale-fast-bilinear-wide-wrap b/tests/ref/fate/filter-scale-fast-bilinear-wide-wrap new file mode 100644 index 0000000000..6084f830d9 --- /dev/null +++ b/tests/ref/fate/filter-scale-fast-bilinear-wide-wrap @@ -0,0 +1,6 @@ +#tb 0: 1/25 +#media_type 0: video +#codec_id 0: rawvideo +#dimensions 0: 1x1 +#sar 0: 0/1 +0, 0, 0, 1, 1, 0x00ed00ed -- 2.52.0 >From cbe6a077fc6376b53063b619b88f85675264be11 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sun, 13 Sep 2026 23:46:12 +0200 Subject: [PATCH 3/3] swscale: stretch the MMXEXT fast bilinear positions by 1 instead of 20 Fixes: out of array read Fixes: p2bTyZBk48yf --- libswscale/utils.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libswscale/utils.c b/libswscale/utils.c index 5004f28933..09549408cf 100644 --- a/libswscale/utils.c +++ b/libswscale/utils.c @@ -1441,8 +1441,8 @@ av_cold int ff_sws_init_single_context(SwsContext *sws, SwsFilter *srcFilter, * some special code for the first and last pixel */ if (flags & SWS_FAST_BILINEAR) { if (c->canMMXEXTBeUsed) { - lumXInc += 20; - chrXInc += 20; + lumXInc += 1; + chrXInc += 1; } // we don't use the x86 asm scaler if MMX is available else if (INLINE_MMX(cpu_flags) && c->dstBpc <= 14) { -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
