diff options
| author | Paul B Mahol <onemda@gmail.com> | 2019-10-16 12:13:04 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2022-04-07 16:26:59 +0200 |
| commit | 84fdfdf8595150c04b86febd1ef2eae3878c84b8 (patch) | |
| tree | 7da771bc7c9d3f340e646af3b77ad459051a8710 | |
| parent | 15900ff8e68f38404bd6d392d474d99f65cdbbf9 (diff) | |
| download | ffmpeg-84fdfdf8595150c04b86febd1ef2eae3878c84b8.tar.gz | |
avfilter/vf_gblur: fix heap-buffer overflow
Fixes #8282
(cherry picked from commit 64a805883d7223c868a683f0030837d859edd2ab)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavfilter/vf_gblur.c | 2 | ||||
| -rw-r--r-- | libavfilter/x86/vf_gblur.asm | 4 |
2 files changed, 3 insertions, 3 deletions
diff --git a/libavfilter/vf_gblur.c b/libavfilter/vf_gblur.c index e71b33da80..f0d861852f 100644 --- a/libavfilter/vf_gblur.c +++ b/libavfilter/vf_gblur.c @@ -236,7 +236,7 @@ static int config_input(AVFilterLink *inlink) s->nb_planes = av_pix_fmt_count_planes(inlink->format); - s->buffer = av_malloc_array(inlink->w, inlink->h * sizeof(*s->buffer)); + s->buffer = av_malloc_array(FFALIGN(inlink->w, 16), FFALIGN(inlink->h, 16) * sizeof(*s->buffer)); if (!s->buffer) return AVERROR(ENOMEM); diff --git a/libavfilter/x86/vf_gblur.asm b/libavfilter/x86/vf_gblur.asm index 762c953c85..a25b1659f5 100644 --- a/libavfilter/x86/vf_gblur.asm +++ b/libavfilter/x86/vf_gblur.asm @@ -100,7 +100,7 @@ cglobal horiz_slice, 4, 9, 9, ptr, width, height, steps, nu, bscale, x, y, step, add widthq, remainq cmp xq, widthq - je .end_scalar + jge .end_scalar .loop_scalar: ; ptr[x] += nu * ptr[x-1] @@ -148,7 +148,7 @@ cglobal horiz_slice, 4, 9, 9, ptr, width, height, steps, nu, bscale, x, y, step, jg .loop_x_back cmp xq, 0 - je .end_scalar_back + jle .end_scalar_back .loop_scalar_back: ; ptr[x-1] += nu * ptr[x] |