diff options
| author | Stefano Sabatini <stefano.sabatini-lala@poste.it> | 2011-08-03 00:01:41 +0200 |
|---|---|---|
| committer | Stefano Sabatini <stefano.sabatini-lala@poste.it> | 2011-08-03 11:18:15 +0200 |
| commit | a342517710690a8f113986e8d8e9d9ffabb701fe (patch) | |
| tree | c5b9e577e2c7d2dcf10c579149e390415dc0e317 | |
| parent | d68ba3feb80f9fbb6c80c2ede4a105062084fef8 (diff) | |
| download | ffmpeg-a342517710690a8f113986e8d8e9d9ffabb701fe.tar.gz | |
vf_boxblur: fix out-of-buffer access when h > w
Increase size of the private temporary buffers from w to FFMAX(w, h),
indeed they are used also for blurring vertical lines with length h.
| -rw-r--r-- | libavfilter/vf_boxblur.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavfilter/vf_boxblur.c b/libavfilter/vf_boxblur.c index 398014a0b9..676d2057cb 100644 --- a/libavfilter/vf_boxblur.c +++ b/libavfilter/vf_boxblur.c @@ -144,8 +144,8 @@ static int config_input(AVFilterLink *inlink) char *expr; int ret; - if (!(boxblur->temp[0] = av_malloc(w)) || - !(boxblur->temp[1] = av_malloc(w))) + if (!(boxblur->temp[0] = av_malloc(FFMAX(w, h))) || + !(boxblur->temp[1] = av_malloc(FFMAX(w, h)))) return AVERROR(ENOMEM); boxblur->hsub = desc->log2_chroma_w; |