PR #24674 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24674 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24674.patch
libavcodec and libavfilter only produce pictures that pass av_image_check_size2() and the width arithmetic copes with those, so apply the same limit to the sizes a context is created with. Fixes: out of array access Fixes: left shift of 1073741824 by 2 places cannot be represented in type 'int' Fixes: V5KypI022pwg Fixes: poc_swscale.c Replicated through API Found-by: Anthony Hurtado >From 68fddafb722a8eda52ab73feb5277aefa0287f57 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Thu, 24 Sep 2026 01:00:49 +0200 Subject: [PATCH] libswscale: reject sizes that av_image_check_size2() refuses libavcodec and libavfilter only produce pictures that pass av_image_check_size2() and the width arithmetic copes with those, so apply the same limit to the sizes a context is created with. Fixes: out of array access Fixes: left shift of 1073741824 by 2 places cannot be represented in type 'int' Fixes: V5KypI022pwg Fixes: poc_swscale.c Replicated through API Found-by: Anthony Hurtado --- libswscale/utils.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libswscale/utils.c b/libswscale/utils.c index 55ac6c9efb..1bdc7baa54 100644 --- a/libswscale/utils.c +++ b/libswscale/utils.c @@ -1244,6 +1244,12 @@ av_cold int ff_sws_init_single_context(SwsContext *sws, SwsFilter *srcFilter, return AVERROR(EINVAL); } + ret = av_image_check_size2(srcW, srcH, INT64_MAX, AV_PIX_FMT_NONE, 0, c); + if (ret >= 0) + ret = av_image_check_size2(dstW, dstH, INT64_MAX, AV_PIX_FMT_NONE, 0, c); + if (ret < 0) + return ret; + if (!dstFilter) dstFilter = &dummyFilter; if (!srcFilter) -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
