[FFmpeg-devel] [PATCH] vf_unsharp: fix out-of-buffer read

Stefano Sabatini stefano.sabatini-lala at poste.it
Sat Aug 13 01:11:21 CEST 2011


In unsharpen(), when y is >= height prevent reading from src out of
buffer, but reads from the last buffer line in src2.

The check was implemented in the original unsharp libmpcodecs code,
slso fix output discrepancy between the two filters.
---
 libavfilter/vf_unsharp.c |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/libavfilter/vf_unsharp.c b/libavfilter/vf_unsharp.c
index 3542ca3..2bc090f 100644
--- a/libavfilter/vf_unsharp.c
+++ b/libavfilter/vf_unsharp.c
@@ -70,6 +70,7 @@ static void unsharpen(uint8_t *dst, const uint8_t *src, int dst_stride, int src_
 
     int32_t res;
     int x, y, z;
+    const uint8_t *src2;
 
     if (!fp->amount) {
         if (dst_stride == src_stride)
@@ -84,9 +85,12 @@ static void unsharpen(uint8_t *dst, const uint8_t *src, int dst_stride, int src_
         memset(sc[y], 0, sizeof(sc[y][0]) * (width + 2 * fp->steps_x));
 
     for (y = -fp->steps_y; y < height + fp->steps_y; y++) {
+        if (y < height)
+            src2 = src;
+
         memset(sr, 0, sizeof(sr[0]) * (2 * fp->steps_x - 1));
         for (x = -fp->steps_x; x < width + fp->steps_x; x++) {
-            tmp1 = x <= 0 ? src[0] : x >= width ? src[width-1] : src[x];
+            tmp1 = x <= 0 ? src2[0] : x >= width ? src2[width-1] : src2[x];
             for (z = 0; z < fp->steps_x * 2; z += 2) {
                 tmp2 = sr[z + 0] + tmp1; sr[z + 0] = tmp1;
                 tmp1 = sr[z + 1] + tmp2; sr[z + 1] = tmp2;
-- 
1.7.2.5



More information about the ffmpeg-devel mailing list