[FFmpeg-cvslog] avfilter: fix plane validity checks

[Michael Niedermayer]

ffmpeg | branch: release/1.2 | Michael Niedermayer <michaelni at gmx.at> | Sat Aug  3 18:54:43 2013 +0200| [64d362fce718d5dfe108c147971ca9558f5bed24] | committer: Michael Niedermayer

avfilter: fix plane validity checks

Fixes out of array accesses

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit e43a0a232dbf6d3c161823c2e07c52e76227a1bc)

Conflicts:

	libavfilter/vf_delogo.c
	libavfilter/vf_fieldmatch.c
	libavfilter/vf_fieldorder.c
	libavfilter/vf_hflip.c
	libavfilter/vf_kerndeint.c
	libavfilter/vf_lut.c
	libavfilter/vf_pad.c
	libavfilter/vf_showinfo.c
	libavfilter/vf_vignette.c

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=64d362fce718d5dfe108c147971ca9558f5bed24
---

 libavfilter/vf_boxblur.c    |    4 ++--
 libavfilter/vf_delogo.c     |    2 +-
 libavfilter/vf_fieldorder.c |    2 +-
 libavfilter/vf_gradfun.c    |    2 +-
 libavfilter/vf_hflip.c      |    2 +-
 libavfilter/vf_kerndeint.c  |    2 +-
 libavfilter/vf_lut.c        |    2 +-
 libavfilter/vf_pad.c        |    2 +-
 libavfilter/vf_showinfo.c   |    4 ++--
 9 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/libavfilter/vf_boxblur.c b/libavfilter/vf_boxblur.c
index a4ac50a..25c9f7d 100644
--- a/libavfilter/vf_boxblur.c
+++ b/libavfilter/vf_boxblur.c
@@ -346,13 +346,13 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *in)
     }
     avfilter_copy_buffer_ref_props(out, in);
 
-    for (plane = 0; in->data[plane] && plane < 4; plane++)
+    for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++)
         hblur(out->data[plane], out->linesize[plane],
               in ->data[plane], in ->linesize[plane],
               w[plane], h[plane], boxblur->radius[plane], boxblur->power[plane],
               boxblur->temp);
 
-    for (plane = 0; in->data[plane] && plane < 4; plane++)
+    for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++)
         vblur(out->data[plane], out->linesize[plane],
               out->data[plane], out->linesize[plane],
               w[plane], h[plane], boxblur->radius[plane], boxblur->power[plane],
diff --git a/libavfilter/vf_delogo.c b/libavfilter/vf_delogo.c
index bf0ac62..ed5423e 100644
--- a/libavfilter/vf_delogo.c
+++ b/libavfilter/vf_delogo.c
@@ -232,7 +232,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *in)
         avfilter_copy_buffer_ref_props(out, in);
     }
 
-    for (plane = 0; plane < 4 && in->data[plane]; plane++) {
+    for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++) {
         int hsub = plane == 1 || plane == 2 ? hsub0 : 0;
         int vsub = plane == 1 || plane == 2 ? vsub0 : 0;
 
diff --git a/libavfilter/vf_fieldorder.c b/libavfilter/vf_fieldorder.c
index 06e0369..e2dfefe 100644
--- a/libavfilter/vf_fieldorder.c
+++ b/libavfilter/vf_fieldorder.c
@@ -137,7 +137,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *frame)
             "picture will move %s one line\n",
             s->dst_tff ? "up" : "down");
     h = frame->video->h;
-    for (plane = 0; plane < 4 && frame->data[plane]; plane++) {
+    for (plane = 0; plane < 4 && frame->data[plane] && frame->linesize[plane]; plane++) {
         line_step = frame->linesize[plane];
         line_size = s->line_size[plane];
         data = frame->data[plane];
diff --git a/libavfilter/vf_gradfun.c b/libavfilter/vf_gradfun.c
index 13154f0..e488232 100644
--- a/libavfilter/vf_gradfun.c
+++ b/libavfilter/vf_gradfun.c
@@ -216,7 +216,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *in)
         avfilter_copy_buffer_ref_props(out, in);
     }
 
-    for (p = 0; p < 4 && in->data[p]; p++) {
+    for (p = 0; p < 4 && in->data[p] && in->linesize[p]; p++) {
         int w = inlink->w;
         int h = inlink->h;
         int r = gf->radius;
diff --git a/libavfilter/vf_hflip.c b/libavfilter/vf_hflip.c
index c3b92c2..fc88fe2 100644
--- a/libavfilter/vf_hflip.c
+++ b/libavfilter/vf_hflip.c
@@ -90,7 +90,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *in)
     if (av_pix_fmt_desc_get(inlink->format)->flags & PIX_FMT_PAL)
         memcpy(out->data[1], in->data[1], AVPALETTE_SIZE);
 
-    for (plane = 0; plane < 4 && in->data[plane]; plane++) {
+    for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++) {
         step = flip->max_step[plane];
         hsub = (plane == 1 || plane == 2) ? flip->hsub : 0;
         vsub = (plane == 1 || plane == 2) ? flip->vsub : 0;
diff --git a/libavfilter/vf_kerndeint.c b/libavfilter/vf_kerndeint.c
index 9b77e09..b694027 100644
--- a/libavfilter/vf_kerndeint.c
+++ b/libavfilter/vf_kerndeint.c
@@ -162,7 +162,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *inpic)
     avfilter_copy_buffer_ref_props(outpic, inpic);
     outpic->video->interlaced = 0;
 
-    for (plane = 0; inpic->data[plane] && plane < 4; plane++) {
+    for (plane = 0; plane < 4 && inpic->data[plane] && inpic->linesize[plane]; plane++) {
         h = plane == 0 ? inlink->h : inlink->h >> kerndeint->vsub;
         bwidth = kerndeint->tmp_bwidth[plane];
 
diff --git a/libavfilter/vf_lut.c b/libavfilter/vf_lut.c
index bdfe712..350f4af 100644
--- a/libavfilter/vf_lut.c
+++ b/libavfilter/vf_lut.c
@@ -298,7 +298,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *in)
         }
     } else {
         /* planar */
-        for (plane = 0; plane < 4 && in->data[plane]; plane++) {
+        for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++) {
             int vsub = plane == 1 || plane == 2 ? lut->vsub : 0;
             int hsub = plane == 1 || plane == 2 ? lut->hsub : 0;
 
diff --git a/libavfilter/vf_pad.c b/libavfilter/vf_pad.c
index 5c146f2..a4f99c8 100644
--- a/libavfilter/vf_pad.c
+++ b/libavfilter/vf_pad.c
@@ -254,7 +254,7 @@ static AVFilterBufferRef *get_video_buffer(AVFilterLink *inlink, int perms, int
     picref->video->w = w;
     picref->video->h = h;
 
-    for (plane = 0; plane < 4 && picref->data[plane]; plane++)
+    for (plane = 0; plane < 4 && picref->data[plane] && picref->linesize[plane]; plane++)
         picref->data[plane] += FFALIGN(pad->x >> pad->draw.hsub[plane], align) * pad->draw.pixelstep[plane] +
                                       (pad->y >> pad->draw.vsub[plane])        * picref->linesize[plane];
 
diff --git a/libavfilter/vf_showinfo.c b/libavfilter/vf_showinfo.c
index f91721d..402f6bf 100644
--- a/libavfilter/vf_showinfo.c
+++ b/libavfilter/vf_showinfo.c
@@ -50,7 +50,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *frame)
     uint32_t plane_checksum[4] = {0}, checksum = 0;
     int i, plane, vsub = desc->log2_chroma_h;
 
-    for (plane = 0; plane < 4 && frame->data[plane]; plane++) {
+    for (plane = 0; plane < 4 && frame->data[plane] && frame->linesize[plane]; plane++) {
         int64_t linesize = av_image_get_linesize(frame->format, frame->video->w, plane);
         uint8_t *data = frame->data[plane];
         int h = plane == 1 || plane == 2 ? inlink->h >> vsub : inlink->h;
@@ -80,7 +80,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *frame)
            av_get_picture_type_char(frame->video->pict_type),
            checksum, plane_checksum[0]);
 
-    for (plane = 1; plane < 4 && frame->data[plane]; plane++)
+    for (plane = 1; plane < 4 && frame->data[plane] && frame->linesize[plane]; plane++)
         av_log(ctx, AV_LOG_INFO, " %08X", plane_checksum[plane]);
     av_log(ctx, AV_LOG_INFO, "]\n");