mirror of
https://git.ffmpeg.org/ffmpeg.git
synced 2026-04-18 08:30:24 +00:00
Reproduce:
ffmpeg -i /tmp/bwdif_test_input_160x4_gray16.jpg -vf "bwdif" -f null -
filter_intra accesses rows 3 lines away via cur[mrefs3] and cur[prefs3].
For small height videos (h <= 4), this causes heap-buffer-overflow.
Add boundary check for filter_intra when YADIF_FIELD_END is set.
The boundary condition (y < 3) or (y + 3 >= td->h) precisely matches
filter_intra's 3-line context requirement.
Test file: 160x4 gray16 JPEG
https://code.ffmpeg.org/attachments/db2ace24-bc00-4af6-a53a-5df6b0d51b15
fix #21570
Reviewed-by: Thomas Mundt <tmundt75@gmail.com>
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| api | ||
| checkasm | ||
| fate | ||
| filtergraphs | ||
| maps | ||
| ref | ||
| streamgroups | ||
| .gitignore | ||
| audiogen.c | ||
| audiomatch.c | ||
| base64.c | ||
| copycooker.sh | ||
| extended.ffconcat | ||
| fate-run.sh | ||
| fate-valgrind.supp | ||
| fate.sh | ||
| Makefile | ||
| md5.sh | ||
| refcmp-metadata.awk | ||
| reference.pnm | ||
| rotozoom.c | ||
| simple1.ffconcat | ||
| simple2.ffconcat | ||
| test.ffmeta | ||
| tiny_psnr.c | ||
| tiny_ssim.c | ||
| utils.c | ||
| videogen.c | ||