PR #24622 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24622 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24622.patch
Found-by: zhang xingxing <[email protected]> Suggested-by: zhang xingxing <[email protected]> Fixes: out of array read Fixes: 5GvFWV0LII0w >From d7af4283469ab519bd3c3ac99e1c23a347032005 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Tue, 22 Sep 2026 00:30:20 +0200 Subject: [PATCH] avfilter/vf_bm3d: reject planes smaller than the block size Found-by: zhang xingxing <[email protected]> Suggested-by: zhang xingxing <[email protected]> Fixes: out of array read Fixes: 5GvFWV0LII0w --- libavfilter/vf_bm3d.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/libavfilter/vf_bm3d.c b/libavfilter/vf_bm3d.c index 16f4d98ac6..b278d16681 100644 --- a/libavfilter/vf_bm3d.c +++ b/libavfilter/vf_bm3d.c @@ -776,6 +776,15 @@ static int config_input(AVFilterLink *inlink) s->pblock_size = FFALIGN(s->block_size * 2, av_cpu_max_align()); s->pgroup_size = FFALIGN(s->group_size * 2, av_cpu_max_align()); + for (int p = 0; p < s->nb_planes; p++) { + if (!((1 << p) & s->planes)) + continue; + if (s->planewidth[p] < s->block_size || s->planeheight[p] < s->block_size) { + av_log(ctx, AV_LOG_ERROR, "Plane %d is smaller than the block size\n", p); + return AVERROR(EINVAL); + } + } + for (int i = 0; i < s->nb_threads; i++) { SliceContext *sc = &s->slices[i]; float iscale = 0.5f / s->block_size; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
