highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avfilter/vf_sr: fix read out of bounds

Browse Source 
Signed-off-by: Pedro Arthur <bygrandao@gmail.com>
This commit is contained in:
Zhao Zhili 2018-09-19 10:55:11 +08:00 committed by Pedro Arthur
parent 076558a9f4
commit 0d7a75e848
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavfilter/vf_sr.c
View File

@ -227,7 +227,8 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
0, sr_context->sws_slice_h, out->data, out->linesize); 0, sr_context->sws_slice_h, out->data, out->linesize);
sws_scale(sr_context->sws_contexts[1], (const uint8_t **)out->data, out->linesize, sws_scale(sr_context->sws_contexts[1], (const uint8_t **)out->data, out->linesize,
0, out->height, (uint8_t * const*)(&sr_context->input.data), &sr_context->sws_input_linesize); 0, out->height, (uint8_t * const*)(&sr_context->input.data),
(const int [4]){sr_context->sws_input_linesize, 0, 0, 0});
} }
else{ else{
if (sr_context->sws_contexts[0]){ if (sr_context->sws_contexts[0]){
@ -238,7 +239,8 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
} }
sws_scale(sr_context->sws_contexts[1], (const uint8_t **)in->data, in->linesize, sws_scale(sr_context->sws_contexts[1], (const uint8_t **)in->data, in->linesize,
0, in->height, (uint8_t * const*)(&sr_context->input.data), &sr_context->sws_input_linesize); 0, in->height, (uint8_t * const*)(&sr_context->input.data),
(const int [4]){sr_context->sws_input_linesize, 0, 0, 0});
} }
av_frame_free(&in); av_frame_free(&in);
@ -248,7 +250,8 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
return AVERROR(EIO); return AVERROR(EIO);
} }
sws_scale(sr_context->sws_contexts[2], (const uint8_t **)(&sr_context->output.data), &sr_context->sws_output_linesize, sws_scale(sr_context->sws_contexts[2], (const uint8_t **)(&sr_context->output.data),
(const int[4]){sr_context->sws_output_linesize, 0, 0, 0},
0, out->height, (uint8_t * const*)out->data, out->linesize); 0, out->height, (uint8_t * const*)out->data, out->linesize);
return ff_filter_frame(outlink, out); return ff_filter_frame(outlink, out);