PR #23779 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23779.patch
Fixes: out of array access Fixes: 7aj_swaprect_odd17_nv12.nut / 7aj_generate_swaprect_odd17_nv12.py Fixes: VRAXYvKtmKa8 Found-by: Adrian Junge (vurlo) <[email protected]> >From f67e2265ae715b06417bbc173eb7d3eada274e61 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer <[email protected]> Date: Sat, 11 Jul 2026 16:46:39 +0200 Subject: [PATCH] avfilter/vf_swaprect: size the temp row buffer for the widest plane Fixes: out of array access Fixes: 7aj_swaprect_odd17_nv12.nut / 7aj_generate_swaprect_odd17_nv12.py Fixes: VRAXYvKtmKa8 Found-by: Adrian Junge (vurlo) <[email protected]> --- libavfilter/vf_swaprect.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/libavfilter/vf_swaprect.c b/libavfilter/vf_swaprect.c index 5d93f51c30..acb384e3ff 100644 --- a/libavfilter/vf_swaprect.c +++ b/libavfilter/vf_swaprect.c @@ -200,6 +200,7 @@ static int config_input(AVFilterLink *inlink) { AVFilterContext *ctx = inlink->dst; SwapRectContext *s = ctx->priv; + int size = 0; if (!s->w || !s->h || !s->x1 || !s->y1 || @@ -210,7 +211,14 @@ static int config_input(AVFilterLink *inlink) av_image_fill_max_pixsteps(s->pixsteps, NULL, s->desc); s->nb_planes = av_pix_fmt_count_planes(inlink->format); - s->temp = av_malloc_array(inlink->w, s->pixsteps[0]); + for (int p = 0; p < s->nb_planes; p++) { + int linesize = av_image_get_linesize(inlink->format, inlink->w, p); + if (linesize < 0) + return linesize; + size = FFMAX(size, linesize); + } + + s->temp = av_malloc(size); if (!s->temp) return AVERROR(ENOMEM); -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
