PR #25187 opened by Marti2203 URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25187 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25187.patch
Reflect mode mirrors around the edge pixel without repeating it, so a border of `n` lines reads lines up to `2 * n` away from the edge (`ptr[(planeheight - bottom - 2 - y) * linesize]`, `ptr[... + planewidth - right - 2 - x]`, `top * 2 - y`, `left * 2 - x`, in both `reflect_borders8()` and `reflect_borders16()`). `config_input()` only checks the borders against half the frame size (`inlink->h < s->bottom * 2` etc.), which is enough for mirror mode, but in reflect mode a border of exactly half the size is accepted: ``` ffmpeg -f lavfi -i testsrc2=s=16x10:d=0.04,format=gray16le -vf fillborders=mode=reflect:bottom=5 -f null - ``` With `bottom` or `right` equal to half the height or width, the filter reads one line / one pixel before the start of the plane (Valgrind: invalid read, for 8-bit and 16-bit formats). With `top` or `left` equal to half, it reflects the line at `h` or the column at `w`, i.e. outside the image (this stays within the frame padding, so Valgrind does not flag it, but the output pixels are garbage). With the patch, reflect mode requires each border to be smaller than half the frame size and otherwise fails with "Borders must be smaller than half the input frame size in reflect mode." The largest valid borders (e.g. 16x10 with top/bottom 4 and left/right 7) give byte-identical output before and after for gray, gray16le and yuv420p, and other modes (e.g. mirror with borders of exactly half) are unchanged. There is no FATE coverage for fillborders. This issue was found by an LLM-Enhanced Static Analysis Engine and verified manually. 🤖 Generated with [Claude Code](https://claude.com/claude-code) From 18a880923ecfae84803bf7b1919914918bfccab5 Mon Sep 17 00:00:00 2001 From: Martin Mirchev <[email protected]> Date: Sun, 18 Oct 2026 19:38:12 +0800 Subject: [PATCH] avfilter/vf_fillborders: reject borders of half the frame in reflect mode Reflect mode mirrors around the edge pixel without repeating it, so a border of n lines reads lines up to 2 * n away from the edge. The borders were only checked against half the frame size, which is enough for mirror mode but not here: with bottom or right equal to half the height or width the filter read before the start of the plane, and with top or left equal to half it reflected lines outside the image. Signed-off-by: Martin Mirchev <[email protected]> --- libavfilter/vf_fillborders.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libavfilter/vf_fillborders.c b/libavfilter/vf_fillborders.c index 0ee4f14ab9..3ba009dae4 100644 --- a/libavfilter/vf_fillborders.c +++ b/libavfilter/vf_fillborders.c @@ -617,6 +617,14 @@ static int config_input(AVFilterLink *inlink) return AVERROR(EINVAL); } + /* reflect does not repeat the edge pixel, so it reads 2 * border + 1 lines */ + if (s->mode == FM_REFLECT && + (inlink->w <= s->left * 2 || inlink->w <= s->right * 2 || + inlink->h <= s->top * 2 || inlink->h <= s->bottom * 2)) { + av_log(ctx, AV_LOG_ERROR, "Borders must be smaller than half the input frame size in reflect mode.\n"); + return AVERROR(EINVAL); + } + s->borders[0].left = s->borders[3].left = s->left; s->borders[0].right = s->borders[3].right = s->right; s->borders[0].top = s->borders[3].top = s->top; -- 2.54.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
