[FFmpeg-cvslog] avfilter/vf_floodfill: better fix for crash

[Paul B Mahol]

ffmpeg | branch: master | Paul B Mahol <onemda at gmail.com> | Wed Oct 23 10:17:46 2019 +0200| [8732eb124e565c5bd8574351375ccbff28e261c6] | committer: Paul B Mahol

avfilter/vf_floodfill: better fix for crash

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8732eb124e565c5bd8574351375ccbff28e261c6
---

 libavfilter/vf_floodfill.c | 27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/libavfilter/vf_floodfill.c b/libavfilter/vf_floodfill.c
index d40043c234..11c614a089 100644
--- a/libavfilter/vf_floodfill.c
+++ b/libavfilter/vf_floodfill.c
@@ -35,6 +35,7 @@ typedef struct FloodfillContext {
 
     int x, y;
     int s[4];
+    int S[4];
     int d[4];
 
     int nb_planes;
@@ -293,26 +294,30 @@ static int filter_frame(AVFilterLink *link, AVFrame *frame)
     const int h = frame->height;
     int i, ret;
 
-    for (i = 0; i < s->nb_planes; i++) {
-        if (s->s[i] != s->d[i])
-            break;
-    }
-
-    if (i == s->nb_planes)
-        goto end;
-
-    if (ret = av_frame_make_writable(frame))
-        return ret;
-
     if (is_inside(s->x, s->y, w, h)) {
         s->pick_pixel(frame, s->x, s->y, &s0, &s1, &s2, &s3);
 
+        s->S[0] = s0;
+        s->S[1] = s1;
+        s->S[2] = s2;
+        s->S[3] = s3;
+        for (i = 0; i < s->nb_planes; i++) {
+            if (s->S[i] != s->d[i])
+                break;
+        }
+
+        if (i == s->nb_planes)
+            goto end;
+
         if (s->is_same(frame, s->x, s->y, s0, s1, s2, s3)) {
             s->points[s->front].x = s->x;
             s->points[s->front].y = s->y;
             s->front++;
         }
 
+        if (ret = av_frame_make_writable(frame))
+            return ret;
+
         while (s->front > s->back) {
             int x, y;