[FFmpeg-cvslog] avcodec/hevc_filter: copy_CTB() only within width&height
Michael Niedermayer
git at videolan.org
Mon Sep 26 18:13:42 EEST 2022
ffmpeg | branch: release/4.3 | Michael Niedermayer <michael at niedermayer.cc> | Fri Jul 22 00:51:32 2022 +0200| [5c145953a9f904917bd1094562d5be896d2e5728] | committer: Michael Niedermayer
avcodec/hevc_filter: copy_CTB() only within width&height
Fixes: out of array access
Fixes: 49271/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_HEVC_fuzzer-5424984922652672
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 009ef35d384c3df22d8a8be7416dc9d532e91c52)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5c145953a9f904917bd1094562d5be896d2e5728
---
libavcodec/hevc_filter.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/libavcodec/hevc_filter.c b/libavcodec/hevc_filter.c
index 6b9824088c..a45cb6f0fb 100644
--- a/libavcodec/hevc_filter.c
+++ b/libavcodec/hevc_filter.c
@@ -145,11 +145,22 @@ int i, j;
if (((intptr_t)dst | (intptr_t)src | stride_dst | stride_src) & 15) {
for (i = 0; i < height; i++) {
- for (j = 0; j < width; j+=8)
+ for (j = 0; j < width - 7; j+=8)
AV_COPY64U(dst+j, src+j);
dst += stride_dst;
src += stride_src;
}
+ if (width&7) {
+ dst += ((width>>3)<<3) - stride_dst * height;
+ src += ((width>>3)<<3) - stride_src * height;
+ width &= 7;
+ for (i = 0; i < height; i++) {
+ for (j = 0; j < width; j++)
+ dst[j] = src[j];
+ dst += stride_dst;
+ src += stride_src;
+ }
+ }
} else {
for (i = 0; i < height; i++) {
for (j = 0; j < width; j+=16)
More information about the ffmpeg-cvslog
mailing list