From bc5dde5ec0ba79860e566a44439ac72ae4a827f1 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sat, 29 May 2021 11:17:35 +0200 Subject: [PATCH] avfilter/vf_yadif: Fix handing of tiny images Fixes: out of array access Fixes: Ticket8240 Fixes: CVE-2020-22021 Signed-off-by: Michael Niedermayer (cherry picked from commit 7971f62120a55c141ec437aa3f0bacc1c1a3526b) Signed-off-by: Michael Niedermayer (cherry picked from commit bb08ee0c6fb7bdebd37cbf00aefed206909e8f78) Signed-off-by: Michael Niedermayer --- libavfilter/vf_yadif.c | 32 ++++++++++++++++++-------------- 1 file changed, 18 insertions(+), 14 deletions(-) diff --git a/libavfilter/vf_yadif.c b/libavfilter/vf_yadif.c index b32f38b57a..db99914a43 100644 --- a/libavfilter/vf_yadif.c +++ b/libavfilter/vf_yadif.c @@ -120,20 +120,22 @@ static void filter_edges(void *dst1, void *prev1, void *cur1, void *next1, int x; uint8_t *prev2 = parity ? prev : cur ; uint8_t *next2 = parity ? cur : next; + int offset = FFMAX(w - (MAX_ALIGN-1), 3); /* Only edge pixels need to be processed here. A constant value of false * for is_not_edge should let the compiler ignore the whole branch. */ - FILTER(0, 3, 0) + FILTER(0, FFMIN(3, w), 0) - dst = (uint8_t*)dst1 + w - (MAX_ALIGN-1); - prev = (uint8_t*)prev1 + w - (MAX_ALIGN-1); - cur = (uint8_t*)cur1 + w - (MAX_ALIGN-1); - next = (uint8_t*)next1 + w - (MAX_ALIGN-1); + dst = (uint8_t*)dst1 + offset; + prev = (uint8_t*)prev1 + offset; + cur = (uint8_t*)cur1 + offset; + next = (uint8_t*)next1 + offset; prev2 = (uint8_t*)(parity ? prev : cur); next2 = (uint8_t*)(parity ? cur : next); - FILTER(w - (MAX_ALIGN-1), w - 3, 1) - FILTER(w - 3, w, 0) + FILTER(offset, w - 3, 1) + offset = FFMAX(offset, w - 3); + FILTER(offset, w, 0) } @@ -165,20 +167,22 @@ static void filter_edges_16bit(void *dst1, void *prev1, void *cur1, void *next1, int x; uint16_t *prev2 = parity ? prev : cur ; uint16_t *next2 = parity ? cur : next; + int offset = FFMAX(w - (MAX_ALIGN/2-1), 3); mrefs /= 2; prefs /= 2; - FILTER(0, 3, 0) + FILTER(0, FFMIN(3, w), 0) - dst = (uint16_t*)dst1 + w - (MAX_ALIGN/2-1); - prev = (uint16_t*)prev1 + w - (MAX_ALIGN/2-1); - cur = (uint16_t*)cur1 + w - (MAX_ALIGN/2-1); - next = (uint16_t*)next1 + w - (MAX_ALIGN/2-1); + dst = (uint16_t*)dst1 + offset; + prev = (uint16_t*)prev1 + offset; + cur = (uint16_t*)cur1 + offset; + next = (uint16_t*)next1 + offset; prev2 = (uint16_t*)(parity ? prev : cur); next2 = (uint16_t*)(parity ? cur : next); - FILTER(w - (MAX_ALIGN/2-1), w - 3, 1) - FILTER(w - 3, w, 0) + FILTER(offset, w - 3, 1) + offset = FFMAX(offset, w - 3); + FILTER(offset, w, 0) } static int filter_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs)