[FFmpeg-cvslog] avfilter/vf_vmafmotion: Check dimensions

[Michael Niedermayer]

ffmpeg | branch: release/4.4 | Michael Niedermayer <michael at niedermayer.cc> | Sat May 29 09:58:31 2021 +0200| [cea03683b93c1569b33611d71233235933b3cbce] | committer: Michael Niedermayer

avfilter/vf_vmafmotion: Check dimensions

Fixes: out of array access
Fixes: Ticket8241
Fixes: Ticket8246
Fixes: CVE-2020-22019
Fixes: CVE-2020-22033

Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 82ad1b76751bcfad5005440db48c46a4de5d6f02)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=cea03683b93c1569b33611d71233235933b3cbce
---

 libavfilter/vf_vmafmotion.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavfilter/vf_vmafmotion.c b/libavfilter/vf_vmafmotion.c
index 88d0b35095..0730147e7d 100644
--- a/libavfilter/vf_vmafmotion.c
+++ b/libavfilter/vf_vmafmotion.c
@@ -238,6 +238,9 @@ int ff_vmafmotion_init(VMAFMotionData *s,
     int i;
     const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(fmt);
 
+    if (w < 3 || h < 3)
+        return AVERROR(EINVAL);
+
     s->width = w;
     s->height = h;
     s->stride = FFALIGN(w * sizeof(uint16_t), 32);