virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-04-24 04:44:54 +02:00
Code Issues Releases Activity

swscale/utils: Avoid FF_ALLOC_TYPED_ARRAY() and use av_malloc_array() directly

Browse Source 
Fixes: multiple integer overflows
Fixes: out of array access

Regression since: a408d03ee6

The PoC modifies filter parameters generally inaccessable to an attacker

Found-by: Zhenpeng (Leo) Lin from depthfirst
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-01-21 01:38:42 +01:00
committed by michaelni
parent 8349565d52
commit 795bb37a39
1 changed files with 11 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libswscale/utils.c
+11 -6
View File
@@ -103,7 +103,8 @@ int ff_shuffle_filter_coefficients(SwsInternal *c, int *filterPos,
if ((c->srcBpc == 8) && (c->dstBpc <= 14)) {
int16_t *filterCopy = NULL;
if (filterSize > 4) {
if (!FF_ALLOC_TYPED_ARRAY(filterCopy, dstW * filterSize))
filterCopy = av_malloc_array(dstW, filterSize * sizeof(*filterCopy));
if (!filterCopy)
return AVERROR(ENOMEM);
memcpy(filterCopy, filter, dstW * filterSize * sizeof(int16_t));
}
@@ -282,7 +283,8 @@ static av_cold int initFilter(int16_t **outFilter, int32_t **filterPos,
filterSize = FFMIN(filterSize, srcW - 2);
filterSize = FFMAX(filterSize, 1);
if (!FF_ALLOC_TYPED_ARRAY(filter, dstW * filterSize))
filter = av_malloc_array(dstW, filterSize * sizeof(*filter));
if (!filter)
goto nomem;
xDstInSrc = ((dstPos*(int64_t)xInc)>>7) - ((srcPos*0x10000LL)>>7);
for (i = 0; i < dstW; i++) {
@@ -381,7 +383,8 @@ static av_cold int initFilter(int16_t **outFilter, int32_t **filterPos,
if (dstFilter)
filter2Size += dstFilter->length - 1;
av_assert0(filter2Size > 0);
if (!FF_ALLOCZ_TYPED_ARRAY(filter2, dstW * filter2Size))
filter2 = av_malloc_array(dstW, filter2Size * sizeof(*filter2));
if (!filter2)
goto nomem;
for (i = 0; i < dstW; i++) {
int j, k;
@@ -549,7 +552,8 @@ static av_cold int initFilter(int16_t **outFilter, int32_t **filterPos,
// Note the +1 is for the MMX scaler which reads over the end
/* align at 16 for AltiVec (needed by hScale_altivec_real) */
if (!FF_ALLOCZ_TYPED_ARRAY(*outFilter, *outFilterSize * (dstW + 3)))
*outFilter = av_malloc_array(dstW + 3, *outFilterSize * sizeof(**outFilter));
if (!*outFilter)
goto nomem;
/* normalize & store in outFilter */
@@ -1716,8 +1720,9 @@ av_cold int ff_sws_init_single_context(SwsContext *sws, SwsFilter *srcFilter,
goto fail;
#if HAVE_ALTIVEC
if (!FF_ALLOC_TYPED_ARRAY(c->vYCoeffsBank, c->vLumFilterSize * sws->dst_h) ||
!FF_ALLOC_TYPED_ARRAY(c->vCCoeffsBank, c->vChrFilterSize * c->chrDstH))
c->vYCoeffsBank = av_malloc_array(sws->dst_h, c->vLumFilterSize * sizeof(*c->vYCoeffsBank));
c->vCCoeffsBank = av_malloc_array(c->chrDstH, c->vChrFilterSize * sizeof(*c->vCCoeffsBank));
if (c->vYCoeffsBank == NULL || c->vCCoeffsBank == NULL)
goto nomem;
for (i = 0; i < c->vLumFilterSize * sws->dst_h; i++) {