highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avfilter: fix plane validity checks

Browse Source 
Fixes out of array accesses

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e43a0a232dbf6d3c161823c2e07c52e76227a1bc)

Conflicts:

	libavfilter/vf_delogo.c
	libavfilter/vf_fieldmatch.c
	libavfilter/vf_fieldorder.c
	libavfilter/vf_hflip.c
	libavfilter/vf_kerndeint.c
	libavfilter/vf_lut.c
	libavfilter/vf_pad.c
	libavfilter/vf_showinfo.c
	libavfilter/vf_vignette.c

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-08-03 18:54:43 +02:00
parent c55a09a8b6
commit 64d362fce7
9 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavfilter/vf_boxblur.c
View File

@ -346,13 +346,13 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *in)
}
avfilter_copy_buffer_ref_props(out, in);
for (plane = 0; in->data[plane] && plane < 4; plane++)
for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++)
hblur(out->data[plane], out->linesize[plane],
in ->data[plane], in ->linesize[plane],
w[plane], h[plane], boxblur->radius[plane], boxblur->power[plane],
boxblur->temp);
for (plane = 0; in->data[plane] && plane < 4; plane++)
for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++)
vblur(out->data[plane], out->linesize[plane],
out->data[plane], out->linesize[plane],
w[plane], h[plane], boxblur->radius[plane], boxblur->power[plane],

2
libavfilter/vf_delogo.c
View File

@ -232,7 +232,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *in)
avfilter_copy_buffer_ref_props(out, in);
}
for (plane = 0; plane < 4 && in->data[plane]; plane++) {
for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++) {
int hsub = plane == 1 || plane == 2 ? hsub0 : 0;
int vsub = plane == 1 || plane == 2 ? vsub0 : 0;

2
libavfilter/vf_fieldorder.c
View File

@ -137,7 +137,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *frame)
"picture will move %s one line\n",
s->dst_tff ? "up" : "down");
h = frame->video->h;
for (plane = 0; plane < 4 && frame->data[plane]; plane++) {
for (plane = 0; plane < 4 && frame->data[plane] && frame->linesize[plane]; plane++) {
line_step = frame->linesize[plane];
line_size = s->line_size[plane];
data = frame->data[plane];

2
libavfilter/vf_gradfun.c
View File

@ -216,7 +216,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *in)
avfilter_copy_buffer_ref_props(out, in);
}
for (p = 0; p < 4 && in->data[p]; p++) {
for (p = 0; p < 4 && in->data[p] && in->linesize[p]; p++) {
int w = inlink->w;
int h = inlink->h;
int r = gf->radius;

2
libavfilter/vf_hflip.c
View File

@ -90,7 +90,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *in)
if (av_pix_fmt_desc_get(inlink->format)->flags & PIX_FMT_PAL)
memcpy(out->data[1], in->data[1], AVPALETTE_SIZE);
for (plane = 0; plane < 4 && in->data[plane]; plane++) {
for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++) {
step = flip->max_step[plane];
hsub = (plane == 1 || plane == 2) ? flip->hsub : 0;
vsub = (plane == 1 || plane == 2) ? flip->vsub : 0;

2
libavfilter/vf_kerndeint.c
View File

@ -162,7 +162,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *inpic)
avfilter_copy_buffer_ref_props(outpic, inpic);
outpic->video->interlaced = 0;
for (plane = 0; inpic->data[plane] && plane < 4; plane++) {
for (plane = 0; plane < 4 && inpic->data[plane] && inpic->linesize[plane]; plane++) {
h = plane == 0 ? inlink->h : inlink->h >> kerndeint->vsub;
bwidth = kerndeint->tmp_bwidth[plane];

2
libavfilter/vf_lut.c
View File

@ -298,7 +298,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *in)
}
} else {
/* planar */
for (plane = 0; plane < 4 && in->data[plane]; plane++) {
for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++) {
int vsub = plane == 1 || plane == 2 ? lut->vsub : 0;
int hsub = plane == 1 || plane == 2 ? lut->hsub : 0;

2
libavfilter/vf_pad.c
View File

@ -254,7 +254,7 @@ static AVFilterBufferRef *get_video_buffer(AVFilterLink *inlink, int perms, int
picref->video->w = w;
picref->video->h = h;
for (plane = 0; plane < 4 && picref->data[plane]; plane++)
for (plane = 0; plane < 4 && picref->data[plane] && picref->linesize[plane]; plane++)
picref->data[plane] += FFALIGN(pad->x >> pad->draw.hsub[plane], align) * pad->draw.pixelstep[plane] +
(pad->y >> pad->draw.vsub[plane]) * picref->linesize[plane];

4
libavfilter/vf_showinfo.c
View File

@ -50,7 +50,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *frame)
uint32_t plane_checksum[4] = {0}, checksum = 0;
int i, plane, vsub = desc->log2_chroma_h;
for (plane = 0; plane < 4 && frame->data[plane]; plane++) {
for (plane = 0; plane < 4 && frame->data[plane] && frame->linesize[plane]; plane++) {
int64_t linesize = av_image_get_linesize(frame->format, frame->video->w, plane);
uint8_t *data = frame->data[plane];
int h = plane == 1 || plane == 2 ? inlink->h >> vsub : inlink->h;
@ -80,7 +80,7 @@ static int filter_frame(AVFilterLink *inlink, AVFilterBufferRef *frame)
av_get_picture_type_char(frame->video->pict_type),
checksum, plane_checksum[0]);
for (plane = 1; plane < 4 && frame->data[plane]; plane++)
for (plane = 1; plane < 4 && frame->data[plane] && frame->linesize[plane]; plane++)
av_log(ctx, AV_LOG_INFO, " %08X", plane_checksum[plane]);
av_log(ctx, AV_LOG_INFO, "]\n");