highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/hevc_filter: copy_CTB() only within width&height

Browse Source 
Fixes: out of array access
Fixes: 49271/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5424984922652672

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 009ef35d384c3df22d8a8be7416dc9d532e91c52)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2022-07-22 00:51:32 +02:00
parent f198ffcf38
commit 0bea6b5d50
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
libavcodec/hevc_filter.c
View File

@ -145,11 +145,22 @@ int i, j;
if (((intptr_t)dst | (intptr_t)src | stride_dst | stride_src) & 15) { if (((intptr_t)dst | (intptr_t)src | stride_dst | stride_src) & 15) {
for (i = 0; i < height; i++) { for (i = 0; i < height; i++) {
for (j = 0; j < width; j+=8) for (j = 0; j < width - 7; j+=8)
AV_COPY64U(dst+j, src+j); AV_COPY64U(dst+j, src+j);
dst += stride_dst; dst += stride_dst;
src += stride_src; src += stride_src;
} }
if (width&7) {
dst += ((width>>3)<<3) - stride_dst * height;
src += ((width>>3)<<3) - stride_src * height;
width &= 7;
for (i = 0; i < height; i++) {
for (j = 0; j < width; j++)
dst[j] = src[j];
dst += stride_dst;
src += stride_src;
}
}
} else { } else {
for (i = 0; i < height; i++) { for (i = 0; i < height; i++) {
for (j = 0; j < width; j+=16) for (j = 0; j < width; j+=16)