[FFmpeg-devel] [PATCH] lavfi/alphaextract: fix invalid buffer access in case of negative YUV linesize
Stefano Sabatini
stefasab at gmail.com
Fri Dec 7 19:54:35 CET 2012
On date Friday 2012-12-07 19:18:57 +0100, Stefano Sabatini encoded:
> On date Friday 2012-12-07 02:52:52 +0100, Clément Bœsch encoded:
[...]
> Patch updated.
> --
> FFmpeg = Friendly and Faithless Mythic Political Ecletic Guru
> From 32e917d3a02d03bb9c28cc2ef5b56e048a456149 Mon Sep 17 00:00:00 2001
> From: Stefano Sabatini <stefasab at gmail.com>
> Date: Fri, 7 Dec 2012 18:51:33 +0100
> Subject: [PATCH] lavfi/alphaextract: fix assignment of invalid value to
> memcpy in case of linesize < 0
>
> Fix crash, for example in the command:
> ffmpeg -f image2 -vcodec pgmyuv -i tests/vsynth1/%02d.pgm \
> -vf "[in]format=yuv420p,split,alphamerge,split[o3][o4];
> [o4]vflip,alphaextract[alpha];[o3][alpha]alphamerge[out]" \
> -vcodec rawvideo -f nut md5:
> ---
> libavfilter/vf_alphaextract.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/libavfilter/vf_alphaextract.c b/libavfilter/vf_alphaextract.c
> index 60de6ac..f930c51 100644
> --- a/libavfilter/vf_alphaextract.c
> +++ b/libavfilter/vf_alphaextract.c
> @@ -87,7 +87,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *cur_buf)
> }
> }
> } else {
> - const int linesize = FFMIN(out_buf->linesize[Y], cur_buf->linesize[A]);
> + const int linesize = abs(FFMIN(out_buf->linesize[Y], cur_buf->linesize[A]));
> int y;
> for (y = 0; y < out_buf->video->h; y++) {
> memcpy(out_buf->data[Y] + y * out_buf->linesize[Y],
Pushed.
--
FFmpeg = Fundamentalist and Forgiving Merciless Powered Evil God
More information about the ffmpeg-devel
mailing list