[FFmpeg-devel] [PATCH] lavfi/alphaextract: fix invalid buffer access in case of negative YUV linesize

Stefano Sabatini stefasab at gmail.com
Fri Dec 7 19:54:35 CET 2012


On date Friday 2012-12-07 19:18:57 +0100, Stefano Sabatini encoded:
> On date Friday 2012-12-07 02:52:52 +0100, Clément Bœsch encoded:
[...]
> Patch updated.
> -- 
> FFmpeg = Friendly and Faithless Mythic Political Ecletic Guru

> From 32e917d3a02d03bb9c28cc2ef5b56e048a456149 Mon Sep 17 00:00:00 2001
> From: Stefano Sabatini <stefasab at gmail.com>
> Date: Fri, 7 Dec 2012 18:51:33 +0100
> Subject: [PATCH] lavfi/alphaextract: fix assignment of invalid value to
>  memcpy in case of linesize < 0
> 
> Fix crash, for example in the command:
> ffmpeg -f image2 -vcodec pgmyuv -i tests/vsynth1/%02d.pgm \
>   -vf "[in]format=yuv420p,split,alphamerge,split[o3][o4];
>        [o4]vflip,alphaextract[alpha];[o3][alpha]alphamerge[out]" \
>   -vcodec rawvideo -f nut md5:
> ---
>  libavfilter/vf_alphaextract.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/libavfilter/vf_alphaextract.c b/libavfilter/vf_alphaextract.c
> index 60de6ac..f930c51 100644
> --- a/libavfilter/vf_alphaextract.c
> +++ b/libavfilter/vf_alphaextract.c
> @@ -87,7 +87,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *cur_buf)
>              }
>          }
>      } else {
> -        const int linesize = FFMIN(out_buf->linesize[Y], cur_buf->linesize[A]);
> +        const int linesize = abs(FFMIN(out_buf->linesize[Y], cur_buf->linesize[A]));
>          int y;
>          for (y = 0; y < out_buf->video->h; y++) {
>              memcpy(out_buf->data[Y] + y * out_buf->linesize[Y],

Pushed.
-- 
FFmpeg = Fundamentalist and Forgiving Merciless Powered Evil God


More information about the ffmpeg-devel mailing list