[FFmpeg-cvslog] lavfi/alphaextract: fix assignment of invalid size value to memcpy in case linesize < 0

Stefano Sabatini git at videolan.org
Fri Dec 7 19:46:55 CET 2012


ffmpeg | branch: master | Stefano Sabatini <stefasab at gmail.com> | Fri Dec  7 18:51:33 2012 +0100| [130c6497d2e511d1363cb51ddf68dc9cc2c2f987] | committer: Stefano Sabatini

lavfi/alphaextract: fix assignment of invalid size value to memcpy in case linesize < 0

Fix crash, for example in the command:
ffmpeg -f image2 -vcodec pgmyuv -i tests/vsynth1/%02d.pgm \
  -vf "[in]format=yuv420p,split,alphamerge,split[o3][o4];
       [o4]vflip,alphaextract[alpha];[o3][alpha]alphamerge[out]" \
  -vcodec rawvideo -f nut md5:

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=130c6497d2e511d1363cb51ddf68dc9cc2c2f987
---

 libavfilter/vf_alphaextract.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavfilter/vf_alphaextract.c b/libavfilter/vf_alphaextract.c
index 60de6ac..f930c51 100644
--- a/libavfilter/vf_alphaextract.c
+++ b/libavfilter/vf_alphaextract.c
@@ -87,7 +87,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *cur_buf)
             }
         }
     } else {
-        const int linesize = FFMIN(out_buf->linesize[Y], cur_buf->linesize[A]);
+        const int linesize = abs(FFMIN(out_buf->linesize[Y], cur_buf->linesize[A]));
         int y;
         for (y = 0; y < out_buf->video->h; y++) {
             memcpy(out_buf->data[Y] + y * out_buf->linesize[Y],



More information about the ffmpeg-cvslog mailing list