diff options
| author | Marvin Scholz <epirat07@gmail.com> | 2024-07-02 20:38:00 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-07-10 18:10:08 +0200 |
| commit | 6d9c4bd69e81b614cf1e1a809679a7ab840b2b3d (patch) | |
| tree | 3d7a243ed63b738da312f7528d81f9163b24b41a | |
| parent | f2f2b275171d9e3c1c94cdaa87dbbfb3007820c0 (diff) | |
| download | ffmpeg-6d9c4bd69e81b614cf1e1a809679a7ab840b2b3d.tar.gz | |
lavfi/perlin: Fix out of bounds stack buffer write
An incorrect calculation in ff_perlin_init causes a write to the
stack array at index 256, which is out of bounds.
Fixes: CID1608711
Reviewed-by: Stefano Sabatini <stefasab@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavfilter/perlin.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavfilter/perlin.c b/libavfilter/perlin.c index 09bae7ad33..ffad8c1e4e 100644 --- a/libavfilter/perlin.c +++ b/libavfilter/perlin.c @@ -129,7 +129,7 @@ int ff_perlin_init(FFPerlin *perlin, double period, int octaves, double persiste for (i = 0; i < 256; i++) { unsigned int random_idx = av_lfg_get(&lfg) % (256-i); uint8_t random_val = random_permutations[random_idx]; - random_permutations[random_idx] = random_permutations[256-i]; + random_permutations[random_idx] = random_permutations[255-i]; perlin->permutations[i] = perlin->permutations[i+256] = random_val; } |