[FFmpeg-cvslog] avfilter/vf_fieldorder: fix heap-buffer overflow

[Paul B Mahol]

ffmpeg | branch: release/2.8 | Paul B Mahol <onemda at gmail.com> | Sun Oct 13 23:10:16 2019 +0200| [ea5d154845dfc1c6e550d197d7da79aee87c9f66] | committer: Michael Niedermayer

avfilter/vf_fieldorder: fix heap-buffer overflow

Fixes #8264

(cherry picked from commit 07050d7bdc32d82e53ee5bb727f5882323d00dba)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ea5d154845dfc1c6e550d197d7da79aee87c9f66
---

 libavfilter/vf_fieldorder.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/libavfilter/vf_fieldorder.c b/libavfilter/vf_fieldorder.c
index d0d68071fd..594fc4674b 100644
--- a/libavfilter/vf_fieldorder.c
+++ b/libavfilter/vf_fieldorder.c
@@ -109,8 +109,8 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *frame)
             s->dst_tff ? "up" : "down");
     h = frame->height;
     for (plane = 0; plane < 4 && frame->data[plane] && frame->linesize[plane]; plane++) {
-        dst_line_step = out->linesize[plane];
-        src_line_step = frame->linesize[plane];
+        dst_line_step = out->linesize[plane] * (h > 2);
+        src_line_step = frame->linesize[plane] * (h > 2);
         line_size = s->line_size[plane];
         dst = out->data[plane];
         src = frame->data[plane];