Zhao Zhili
b62ae766c1
avfilter/vf_ssim360: fix integer overflow in tape_length allocation
...
tape_length * 8 overflows 32-bit int for large input widths. Then
av_malloc_array() allocates a tiny buffer while the subsequent
loop writes tape_length*8 BilinearMap entries, causing
heap-buffer-overflow.
Validate the value in float before converting to int and left
shifting, to avoid both float-to-int and signed left shift
overflow UB. Also split av_malloc_array() arguments to avoid
the multiplication overflow.
Fixes : #21511
Signed-off-by: Zhao Zhili <zhilizhao@tencent.com >
2026-04-13 19:49:32 +08:00
..
2026-01-09 16:10:10 +00:00
2026-04-04 11:31:16 +00:00
2026-03-21 16:25:40 +08:00
2026-02-03 21:07:29 +00:00
2026-04-09 12:31:24 +02:00
2026-04-06 11:28:49 +02:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-03-10 13:52:19 +01:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-03-10 13:52:19 +01:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-02-26 11:40:16 +08:00
2026-03-13 21:31:54 +01:00
2026-03-21 00:44:30 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-04-08 11:52:44 -03:00
2026-04-09 12:31:24 +02:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-04-10 15:12:18 +02:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-02-10 19:44:46 +01:00
2026-01-24 22:05:34 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-03-10 13:52:19 +01:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-04-10 15:12:18 +02:00
2026-01-21 22:06:12 +00:00
2026-02-28 12:13:02 +00:00
2026-04-12 20:02:18 +00:00
2026-03-29 09:38:01 +00:00
2026-03-06 03:21:37 +01:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-02-10 19:44:43 +01:00
2026-02-10 19:44:43 +01:00
2026-01-19 09:33:49 +00:00
2026-04-10 22:02:00 +02:00
2026-04-10 15:12:18 +02:00
2026-02-10 19:44:46 +01:00
2026-02-10 19:44:46 +01:00
2026-04-09 12:31:24 +02:00
2026-02-14 12:21:10 +00:00
2026-02-14 12:21:10 +00:00
2026-01-13 22:25:53 +00:00
2026-01-24 08:11:19 +00:00
2026-01-05 20:41:59 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-03-11 10:23:35 +01:00
2026-01-24 08:11:19 +00:00
2026-03-31 11:17:51 +00:00
2026-03-13 12:52:57 -03:00
2026-02-19 19:42:26 +01:00
2026-02-10 19:44:43 +01:00
2026-01-15 16:26:09 +00:00
2026-02-26 11:40:16 +08:00
2026-02-26 11:40:16 +08:00
2026-03-10 13:52:19 +01:00
2026-02-19 19:42:26 +01:00
2026-03-14 23:26:51 +08:00
2026-03-10 13:52:19 +01:00
2026-01-24 08:11:19 +00:00
2026-02-26 11:40:16 +08:00
2026-02-26 11:40:16 +08:00
2026-03-06 03:21:37 +01:00
2026-02-10 19:44:46 +01:00
2026-01-24 08:11:19 +00:00
2026-03-06 01:45:09 -05:00
2026-02-26 11:40:16 +08:00
2026-03-26 07:24:15 +00:00
2026-02-03 21:07:29 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-02-10 19:44:43 +01:00
2026-01-24 08:11:19 +00:00
2026-02-10 19:44:46 +01:00
2026-02-26 11:40:16 +08:00
2026-03-22 14:27:36 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-03-09 19:07:34 +01:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-03-27 21:00:53 -03:00
2026-01-02 23:46:42 +08:00
2026-03-25 17:47:09 +00:00
2026-01-24 08:11:19 +00:00
2026-02-10 19:44:43 +01:00
2026-01-27 17:05:27 +00:00
2026-02-26 11:40:16 +08:00
2026-04-05 00:26:55 +00:00
2026-01-09 16:10:10 +00:00
2026-02-19 19:42:31 +01:00
2026-01-09 16:10:10 +00:00
2026-02-14 12:21:10 +00:00
2026-01-24 08:11:19 +00:00
2026-02-10 19:44:43 +01:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-02-10 19:44:46 +01:00
2026-04-04 11:31:16 +00:00
2026-04-02 21:15:06 +02:00
2026-03-06 23:09:44 +01:00
2026-01-24 08:11:19 +00:00
2026-03-11 10:23:35 +01:00
2026-04-13 19:49:32 +08:00
2026-01-03 21:31:30 -03:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-03-27 19:42:08 -03:00
2026-02-10 19:44:43 +01:00
2026-02-26 11:40:16 +08:00
2026-02-26 11:40:16 +08:00
2026-04-09 12:31:24 +02:00
2026-03-25 01:19:08 +00:00
2026-01-24 08:11:19 +00:00
2026-04-01 21:56:37 +08:00
2026-03-31 11:17:51 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-01-24 08:11:19 +00:00
2026-04-10 15:12:18 +02:00
2026-01-29 22:33:33 +01:00
2026-01-24 08:11:19 +00:00
2026-02-26 11:40:16 +08:00
2026-02-26 11:40:16 +08:00
2026-01-30 15:20:08 +01:00
2026-01-12 17:28:41 +01:00