diff options
| author | Andreas Rheinhardt <andreas.rheinhardt@gmail.com> | 2020-10-06 14:35:25 +0200 |
|---|---|---|
| committer | Andreas Rheinhardt <andreas.rheinhardt@gmail.com> | 2021-02-27 07:20:58 +0100 |
| commit | 8b7f2f0ec50fd7faa60ae927e81c608d4c9f6223 (patch) | |
| tree | fe830845c295aa92404609df4a5f4eedeb48f503 | |
| parent | bcf3ac039bcb98a3ab07e80c7ed3a4d41196ebc0 (diff) | |
| download | ffmpeg-8b7f2f0ec50fd7faa60ae927e81c608d4c9f6223.tar.gz | |
avfilter/vf_minterpolate: Reject too small dimensions
The latter code relies upon the dimensions to be not too small;
otherwise one will call av_clip() with min > max lateron which aborts
in case ASSERT_LEVEL is >= 2 or one will get a nonsense result that may
lead to a heap-buffer-overflow/underflow. The latter has happened in
ticket #8248 which this commit fixes.
Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
(cherry picked from commit bb13cdbe279d92f595243a9b3e2b91fb48cf146c)
| -rw-r--r-- | libavfilter/vf_minterpolate.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavfilter/vf_minterpolate.c b/libavfilter/vf_minterpolate.c index c9ce80420d..e1fe5e32b5 100644 --- a/libavfilter/vf_minterpolate.c +++ b/libavfilter/vf_minterpolate.c @@ -363,6 +363,11 @@ static int config_input(AVFilterLink *inlink) } if (mi_ctx->mi_mode == MI_MODE_MCI) { + if (mi_ctx->b_width < 2 || mi_ctx->b_height < 2) { + av_log(inlink->dst, AV_LOG_ERROR, "Height or width < %d\n", + 2 * mi_ctx->mb_size); + return AVERROR(EINVAL); + } mi_ctx->pixel_mvs = av_mallocz_array(width * height, sizeof(PixelMVS)); mi_ctx->pixel_weights = av_mallocz_array(width * height, sizeof(PixelWeights)); mi_ctx->pixel_refs = av_mallocz_array(width * height, sizeof(PixelRefs)); |