diff options
| author | Niklas Haas <git@haasn.dev> | 2024-11-25 14:27:38 +0100 |
|---|---|---|
| committer | Niklas Haas <git@haasn.dev> | 2024-11-25 14:40:49 +0100 |
| commit | bcbf3a56303d043b1c74e500772ed73a5ebab759 (patch) | |
| tree | 8eb06b4d4c737062a8102bd25e4b25750fa9c8d5 | |
| parent | 3c3bf6c109605e6ac053bea343641d2c9dd90dbd (diff) | |
| download | ffmpeg-bcbf3a56303d043b1c74e500772ed73a5ebab759.tar.gz | |
avfilter/vf_scale: fix off-by-one in loop bounds
Results in over-read of the array. Fortunately, the excess element was
never actually used, but it still triggers ASAN (and could in theory trigger
a segfault).
Fixes: 04ce01df0bb2d66e143bcfcea439afc2a1b8d96e
| -rw-r--r-- | libavfilter/vf_scale.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavfilter/vf_scale.c b/libavfilter/vf_scale.c index 5d1eda1a16..d86e50f79b 100644 --- a/libavfilter/vf_scale.c +++ b/libavfilter/vf_scale.c @@ -482,7 +482,7 @@ static int query_formats(const AVFilterContext *ctx, formats = ff_all_color_spaces(); for (int i = 0; i < formats->nb_formats; i++) { if (!sws_test_colorspace(formats->formats[i], 0)) { - for (int j = i--; j < formats->nb_formats; j++) + for (int j = i--; j + 1 < formats->nb_formats; j++) formats->formats[j] = formats->formats[j + 1]; formats->nb_formats--; } @@ -501,7 +501,7 @@ static int query_formats(const AVFilterContext *ctx, formats = ff_all_color_spaces(); for (int i = 0; i < formats->nb_formats; i++) { if (!sws_test_colorspace(formats->formats[i], 1)) { - for (int j = i--; j < formats->nb_formats; j++) + for (int j = i--; j + 1 < formats->nb_formats; j++) formats->formats[j] = formats->formats[j + 1]; formats->nb_formats--; } |