[FFmpeg-cvslog] avfilter/vf_tile: remove limit of max tile size

Paul B Mahol git at videolan.org
Fri Nov 3 22:19:21 EET 2017


ffmpeg | branch: master | Paul B Mahol <onemda at gmail.com> | Tue Oct 10 21:18:03 2017 +0200| [1f24b33d9af83a02ed06a644797028b139281096] | committer: Paul B Mahol

avfilter/vf_tile: remove limit of max tile size

Signed-off-by: Paul B Mahol <onemda at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1f24b33d9af83a02ed06a644797028b139281096
---

 libavfilter/vf_tile.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/libavfilter/vf_tile.c b/libavfilter/vf_tile.c
index 87e0b940cf..e9d246fc73 100644
--- a/libavfilter/vf_tile.c
+++ b/libavfilter/vf_tile.c
@@ -23,6 +23,7 @@
  * tile video filter
  */
 
+#include "libavutil/imgutils.h"
 #include "libavutil/opt.h"
 #include "libavutil/pixdesc.h"
 #include "avfilter.h"
@@ -44,8 +45,6 @@ typedef struct TileContext {
     uint8_t rgba_color[4];
 } TileContext;
 
-#define REASONABLE_SIZE 1024
-
 #define OFFSET(x) offsetof(TileContext, x)
 #define FLAGS AV_OPT_FLAG_VIDEO_PARAM|AV_OPT_FLAG_FILTERING_PARAM
 
@@ -68,12 +67,21 @@ static av_cold int init(AVFilterContext *ctx)
 {
     TileContext *tile = ctx->priv;
 
-    if (tile->w > REASONABLE_SIZE || tile->h > REASONABLE_SIZE) {
+    if (tile->w > UINT_MAX / tile->h) {
         av_log(ctx, AV_LOG_ERROR, "Tile size %ux%u is insane.\n",
                tile->w, tile->h);
         return AVERROR(EINVAL);
     }
 
+    if (tile->padding) {
+        if ((tile->w - 1 > (UINT32_MAX - 2 * tile->margin) / tile->padding) ||
+            (tile->h - 1 > (UINT32_MAX - 2 * tile->margin) / tile->padding)) {
+            av_log(ctx, AV_LOG_ERROR, "Combination of Tile size %ux%u, padding %d and margin %d overflows.\n",
+                   tile->w, tile->h, tile->padding, tile->margin);
+            return AVERROR(EINVAL);
+        }
+    }
+
     if (tile->nb_frames == 0) {
         tile->nb_frames = tile->w * tile->h;
     } else if (tile->nb_frames > tile->w * tile->h) {
@@ -142,6 +150,7 @@ static void draw_blank_frame(AVFilterContext *ctx, AVFrame *out_buf)
                       x0, y0, inlink->w, inlink->h);
     tile->current++;
 }
+
 static int end_last_frame(AVFilterContext *ctx)
 {
     TileContext *tile     = ctx->priv;



More information about the ffmpeg-cvslog mailing list