[FFmpeg-cvslog] avfilter/vf_fieldmatch: fix heap-buffer overflow

Paul B Mahol git at videolan.org
Wed May 4 21:19:02 EEST 2022


ffmpeg | branch: release/4.2 | Paul B Mahol <onemda at gmail.com> | Sat Oct 19 11:56:02 2019 +0200| [b116c7a6b05d96845ebc490e916e7cc3d90c1249] | committer: Michael Niedermayer

avfilter/vf_fieldmatch: fix heap-buffer overflow

Also fix use of uninitialized values.

Fixes #8239

(cherry picked from commit ce5274c1385d55892a692998923802023526b765)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b116c7a6b05d96845ebc490e916e7cc3d90c1249
---

 libavfilter/vf_fieldmatch.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavfilter/vf_fieldmatch.c b/libavfilter/vf_fieldmatch.c
index 5a73eb43b8..8d1e68b85f 100644
--- a/libavfilter/vf_fieldmatch.c
+++ b/libavfilter/vf_fieldmatch.c
@@ -938,7 +938,7 @@ static int config_input(AVFilterLink *inlink)
     fm->tpitchy  = FFALIGN(w,      16);
     fm->tpitchuv = FFALIGN(w >> 1, 16);
 
-    fm->tbuffer = av_malloc(h/2 * fm->tpitchy);
+    fm->tbuffer = av_calloc((h/2 + 4) * fm->tpitchy, sizeof(*fm->tbuffer));
     fm->c_array = av_malloc((((w + fm->blockx/2)/fm->blockx)+1) *
                             (((h + fm->blocky/2)/fm->blocky)+1) *
                             4 * sizeof(*fm->c_array));



More information about the ffmpeg-cvslog mailing list