[FFmpeg-cvslog] avfilter/vf_edgedetect: fix heap-buffer overflow

[Paul B Mahol]

ffmpeg | branch: release/3.4 | Paul B Mahol <onemda at gmail.com> | Tue Oct 15 16:38:40 2019 +0200| [222783e2faeda088a6289931da1b038f3486ee33] | committer: Michael Niedermayer

avfilter/vf_edgedetect: fix heap-buffer overflow

Fixes #8275

(cherry picked from commit de598f82f8c3f8000e1948548e8088148e2b1f44)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=222783e2faeda088a6289931da1b038f3486ee33
---

 libavfilter/vf_edgedetect.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/libavfilter/vf_edgedetect.c b/libavfilter/vf_edgedetect.c
index 49556f33db..c1a21c7334 100644
--- a/libavfilter/vf_edgedetect.c
+++ b/libavfilter/vf_edgedetect.c
@@ -126,7 +126,8 @@ static void gaussian_blur(AVFilterContext *ctx, int w, int h,
         memcpy(dst, src, w); dst += dst_linesize; src += src_linesize;
     for (j = 2; j < h - 2; j++) {
         dst[0] = src[0];
-        dst[1] = src[1];
+        if (w > 1)
+            dst[1] = src[1];
         for (i = 2; i < w - 2; i++) {
             /* Gaussian mask of size 5x5 with sigma = 1.4 */
             dst[i] = ((src[-2*src_linesize + i-2] + src[2*src_linesize + i-2]) * 2
@@ -147,8 +148,10 @@ static void gaussian_blur(AVFilterContext *ctx, int w, int h,
                     + src[i+1] * 12
                     + src[i+2] *  5) / 159;
         }
-        dst[i    ] = src[i    ];
-        dst[i + 1] = src[i + 1];
+        if (w > 2)
+            dst[i    ] = src[i    ];
+        if (w > 3)
+            dst[i + 1] = src[i + 1];
 
         dst += dst_linesize;
         src += src_linesize;