PR #24512 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24512 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24512.patch
Fixes: out of array read Fixes: XuzTudm0onFG Found-by: Zheng Yu @ Depthfirst >From bbafd66eb8abdb6adb1e9800e7d1cb1dfea5babf Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 15 Sep 2026 06:13:53 +0200 Subject: [PATCH] avcodec/mjpegenc: flip AMV pictures starting from the last row of each plane Fixes: out of array read Fixes: XuzTudm0onFG Found-by: Zheng Yu @ Depthfirst --- libavcodec/mjpegenc.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/libavcodec/mjpegenc.c b/libavcodec/mjpegenc.c index ee70e17bcd..b9ebe3d769 100644 --- a/libavcodec/mjpegenc.c +++ b/libavcodec/mjpegenc.c @@ -609,8 +609,6 @@ static av_cold int mjpeg_encode_init(AVCodecContext *avctx) } #if CONFIG_AMV_ENCODER -// maximum over s->mjpeg_vsample[i] -#define V_MAX 2 static int amv_encode_picture(AVCodecContext *avctx, AVPacket *pkt, const AVFrame *pic_arg, int *got_packet) { @@ -633,8 +631,8 @@ static int amv_encode_picture(AVCodecContext *avctx, AVPacket *pkt, return AVERROR(ENOMEM); //picture should be flipped upside-down for(i=0; i < 3; i++) { - int vsample = i ? 2 >> chroma_v_shift : 2; - pic->data[i] += pic->linesize[i] * (vsample * s->c.height / V_MAX - 1); + int v_shift = i ? chroma_v_shift : 0; + pic->data[i] += pic->linesize[i] * (AV_CEIL_RSHIFT(s->c.height, v_shift) - 1); pic->linesize[i] *= -1; } ret = ff_mpv_encode_picture(avctx, pkt, pic, got_packet); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
