[FFmpeg-cvslog] libavfilter/scale2ref: Fix out-of-bounds array access

[Kevin Mark]

ffmpeg | branch: master | Kevin Mark <kmark937 at gmail.com> | Sat Jun  3 05:04:19 2017 -0400| [08213e0b7974b7e75d9031d6e448be49a494c0a1] | committer: Michael Niedermayer

libavfilter/scale2ref: Fix out-of-bounds array access

ff_scale_eval_dimensions blindly assumes that two inputs are always
available as of 3385989b98be7940044e4f0a6b431a0a00abf2fa. This is
notably not the case when the function is called for the scale
filter. With the scale filter inputs[1] does not exist.

ff_scale_eval_dimensions now has an updated scale2ref check that
makes certain two inputs are actually available before attempting to
access the second one.

Thanks to James Almer for reporting this bug. This should fix the 820
Valgrind tests I single-handedly managed to break.

Signed-off-by: Kevin Mark <kmark937 at gmail.com>
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=08213e0b7974b7e75d9031d6e448be49a494c0a1
---

 libavfilter/scale.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavfilter/scale.c b/libavfilter/scale.c
index e3a2fb5923..03745ddcb8 100644
--- a/libavfilter/scale.c
+++ b/libavfilter/scale.c
@@ -115,7 +115,7 @@ int ff_scale_eval_dimensions(void *log_ctx,
     int factor_w, factor_h;
     int eval_w, eval_h;
     int ret;
-    const char scale2ref = outlink->src->inputs[1] == inlink;
+    const char scale2ref = outlink->src->nb_inputs == 2 && outlink->src->inputs[1] == inlink;
     double var_values[VARS_NB + VARS_S2R_NB], res;
     const AVPixFmtDescriptor *main_desc;
     const AVFilterLink *main_link;