diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2023-12-24 20:50:51 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2023-12-29 01:19:05 +0100 |
| commit | e4d2666bdc3dbd177a81bbf428654a5f2fa3787a (patch) | |
| tree | 451067a7a3d9e8ae45936e13dc08680469295a89 | |
| parent | ab0fdaedd1e7224f7e84ea22fcbfaa4ca75a6c06 (diff) | |
| download | ffmpeg-e4d2666bdc3dbd177a81bbf428654a5f2fa3787a.tar.gz | |
avfilter/vf_gradfun: Do not overread last line
The code works in steps of 2 lines and lacks support for odd height
Implementing odd height support is better but for now this fixes the
out of array access
Fixes: out of array access
Fixes: tickets/10702/poc6ffmpe
Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavfilter/vf_gradfun.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavfilter/vf_gradfun.c b/libavfilter/vf_gradfun.c index a71a68ecc1..e8d9cae828 100644 --- a/libavfilter/vf_gradfun.c +++ b/libavfilter/vf_gradfun.c @@ -92,7 +92,7 @@ static void filter(GradFunContext *ctx, uint8_t *dst, const uint8_t *src, int wi for (y = 0; y < r; y++) ctx->blur_line(dc, buf + y * bstride, buf + (y - 1) * bstride, src + 2 * y * src_linesize, src_linesize, width / 2); for (;;) { - if (y < height - r) { + if (y + 1 < height - r) { int mod = ((y + r) / 2) % r; uint16_t *buf0 = buf + mod * bstride; uint16_t *buf1 = buf + (mod ? mod - 1 : r - 1) * bstride; |