From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id DF12A4D0DF for ; Mon, 10 Nov 2025 09:35:08 +0000 (UTC) Authentication-Results: ffbox; dkim=fail (body hash mismatch (got b'K3CXkpXGEgIh2FJGd/LlQnYHRlDX4YIroteDMFJi6K4=', expected b'rDv0Lcyo3s5tKOnF1ik8ZCrUjq848TfelwHBml/87HA=')) header.d=ffmpeg.org header.i=@ffmpeg.org header.a=rsa-sha256 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1762767293; h=content-type : mime-version : to : date : message-id : reply-to : subject : list-id : list-archive : list-archive : list-help : list-owner : list-post : list-subscribe : list-unsubscribe : from : cc : content-transfer-encoding : from; bh=K3CXkpXGEgIh2FJGd/LlQnYHRlDX4YIroteDMFJi6K4=; b=2vnLjMTt6jp/WFrFLZdpRA1SZR61QA7bWlYnVlhrdG1UUkriKUQOoYDRS3Klfs2aUo55p fHYVUBQJleDvIG+QT2+lVzOYPvOuKWmXJeaaEIlgpR6gBnOPJa0/VIL21fVzgWHurKSjb0t ZYRt3hyGsDb4KqnlZnj5/Wa7qnkRKGXWKzpxll6L1S9aRTwT7vbFS/XW63JnlaVFv8y78vS CrLDNUUHmghqZLwUQwKMURvPpXxiwH+Ma8Bup9ATYIEZH7xTVJN2+3IvCjLBwkIAO0YNLKh +Kw+75WaZ18QM0xah4Q5NqA8pgI3oryQ7aXVEQSSOy/gIhw0FEZGVsCxjZEw== Received: from [172.19.0.2] (unknown [172.19.0.2]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 247FA68FC04; Mon, 10 Nov 2025 11:34:53 +0200 (EET) ARC-Seal: i=1; cv=none; a=rsa-sha256; d=ffmpeg.org; s=arc; t=1762767275; b=pc8yUyVk3+x8eo4pwJWzJSWzMPnEi9vJDe4BUTSMLnkxf5vY67bO0f7jmua+XdFFxIte/ PamYtXVGU+E83zQ5cG34uZ5diiktVw3DYCKoMSJCR8MuLKGwEhINPtcPCkGeya+81Qwl7Nm d0t3u408vgA8RHqROd/CrPr2IE0dtZSRGO+XH6v69hfsV16cQMyaY9rh5K3VJKr6WTzgOM8 B5AVJRmU2GGMIfaj5EUCwYsYUNuXXSg5OlQndakxPfByw4qJhJZ+DYTCDrSbS6jhHFD46fT He5zj56iing1zz2/iM4XL69Q5xWfOrW3QLdcOwt1V/sbXPTq4fgfGc1c4yjg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=ffmpeg.org; s=arc; t=1762767275; h=from : sender : reply-to : subject : date : message-id : to : cc : mime-version : content-type : content-transfer-encoding : content-id : content-description : resent-date : resent-from : resent-sender : resent-to : resent-cc : resent-message-id : in-reply-to : references : list-id : list-help : list-unsubscribe : list-subscribe : list-post : list-owner : list-archive; bh=K3CXkpXGEgIh2FJGd/LlQnYHRlDX4YIroteDMFJi6K4=; b=pwUB/dcYiozddWdCeGyaycUG9zXKtJHHN+84pB9Q9OIfsyPNTuqIW7gAf+kwFuz343MJQ n24rhAL4hiC4k7W52xGoMte3NNcpAmZPUdh++PUCs8PtAmGXPD3ub3Tg4Jl4/8IHnnhRC4n awD7JqjJ+IRWxNcuNNj+VyYGH2vVclqdcjgJ5PIAqyhUjbMfmEnOeW1hudpK+kkiHU59P5u M8FbAMbgIzK3ApYcJKFlzh54cqNr/oNBSe4SzEyPzEmgVjwsiC736PwxSdvfjEIN4Vetcqx +rM5jR6cNK3NgPPkBfoEKu45ix5DgwmM7MD+ZtxeramVJJo9EXl0sZkjnzig== ARC-Authentication-Results: i=1; ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none; dmarc=pass header.from=ffmpeg.org policy.dmarc=quarantine Authentication-Results: ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none (Message is not ARC signed); dmarc=pass (Used From Domain Record) header.from=ffmpeg.org policy.dmarc=quarantine DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1762767266; h=content-type : mime-version : content-transfer-encoding : from : to : reply-to : subject : date : from; bh=rDv0Lcyo3s5tKOnF1ik8ZCrUjq848TfelwHBml/87HA=; b=WtlMIwXvnGVtSNynYQURUA1rTv3sZChEn1VSoXpEw57zu90zQR9SefKl+CzPV1VyOBHPh 75d/Yc6Hws88eCRHXU+F7NnsP9TSzwa0v3U5XsGCfnc7bHJ3QUHX+SFLE2P/7d1+0Z+6WFR z1BHwmqktOXwGvP7tepaLt/3WJ+RVwQBHy6C8siMruPwwOJOWSrh35rgxo+OB+XoDKdaG++ u+OZCPLQxJMgm2TSc2i8Ve4IdypP0ET1X5SXvQuNGgG3axs0trSwbZEEUBKE1d/5djxAJDw /Lxtiz2HSXvELoUiDft5SirX5Y+R6i435gM6pDh1kEV1h3MeVUYHnv8bSoIg== Received: from 188d6d40ca7a (code.ffmpeg.org [188.245.149.3]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 6D7C46801AF for ; Mon, 10 Nov 2025 11:34:26 +0200 (EET) Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Date: Mon, 10 Nov 2025 09:34:26 -0000 Message-ID: <176276726662.25.17844784980744310524@2cb04c0e5124> Message-ID-Hash: I4ITDIFWWOQPCXNMUQ6BNARWY7ANJJMY X-Message-ID-Hash: I4ITDIFWWOQPCXNMUQ6BNARWY7ANJJMY X-MailFrom: code@ffmpeg.org X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-ffmpeg-devel.ffmpeg.org-0; header-match-ffmpeg-devel.ffmpeg.org-1; header-match-ffmpeg-devel.ffmpeg.org-2; header-match-ffmpeg-devel.ffmpeg.org-3; emergency; member-moderation X-Mailman-Version: 3.3.10 Precedence: list Reply-To: FFmpeg development discussions and patches Subject: [FFmpeg-devel] [PATCH] swscale/yuv2rgb: fix out-of-bounds access with odd srcSliceH in YUV422 (PR #20883) List-Id: FFmpeg development discussions and patches Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: thomasdullien via ffmpeg-devel Cc: thomasdullien Content-Transfer-Encoding: base64 Archived-At: List-Archive: List-Post: UFIgIzIwODgzIG9wZW5lZCBieSB0aG9tYXNkdWxsaWVuClVSTDogaHR0cHM6Ly9jb2RlLmZmbXBl Zy5vcmcvRkZtcGVnL0ZGbXBlZy9wdWxscy8yMDg4MwpQYXRjaCBVUkw6IGh0dHBzOi8vY29kZS5m Zm1wZWcub3JnL0ZGbXBlZy9GRm1wZWcvcHVsbHMvMjA4ODMucGF0Y2gKCkZvciB0cmFuc3BhcmVu Y3k6IEkgYW0gZXhwZXJpbWVudGluZyB3aXRoIGFuIEFJLWFzc2lzdGVkIHBhdGNoIHByb2Nlc3Ms IHdoZXJlIHRoZSBBSSBhZ2VudCBhdHRlbXB0cyB0byBoZWxwDQpyb290LWNhdXNlIGFuYWx5emUg YSBjcmFzaCBieSBtZWFucyBvZiByZXByb2R1Y2luZyB0aGUgY3Jhc2ggd2l0aCBBU0FOLCBtYWtp bmcgYSByZWNvcmRpbmcgd2l0aCAncnInLCBhbmQNCmRvY3VtZW50aW5nIHRoZSBhbmFseXNpcyBh dCBhIGdyYW51bGFyIGxldmVsIHdpdGggdmVyYmF0aW0gcXVvdGVzIGZyb20gdGhlICdycicgdHJh Y2UuIFRoaXMgcm9vdC1jYXVzZSBhbmFseXNpcw0KaXMgdGhlbiBpdGVyYXRpdmVseSByZXZpZXdl ZCAoZS5nLiBhcyBhIGh1bWFuIHJldmlld2VyIEkgY2hlY2sgaXQgZm9yIGFjY3VyYWN5IGFuZCBw bGF1c2liaWxpdHkpIGJlZm9yZSBhIHBhdGNoIGlzDQpnZW5lcmF0ZWQuIFRoZSBwcm9jZXNzIGdl bmVyYXRlcyBhIGRldGFpbGVkIGFuYWx5c2lzIHJlcG9ydCwgYW4gJ3JyJyB0cmFjZSB0aGF0IGNh biBiZSBzaGFyZWQgd2l0aCBvdGhlciB0byBoZWxwDQp3aXRoIHRoZSB2ZXJpZmljYXRpb24sIGFu ZCBhIHBhdGNoLiBHaXZlbiB0aGF0IGl0IGlzIHVubGVhciBob3cgdG8gYmVzdCBzaGFyZSB0aGUg J3JyJyB0cmFjZSwgSSBoYXZlIG9ubHkgYXR0YWNoZWQgdGhlDQpkZXRhaWxlZCByb290LWNhdXNl IGFuYWx5c2lzIGRvY3VtZW50IHRoYXQgd2FzIGF0IHRoZSBlbmQgb2YgdGhlIGl0ZXJhdGl2ZSBw cm9jZXNzLg0KDQpUZXN0cyBoYXZlIGJlZW4gcnVuIGFuZCBwYXNzLg0KDQo9PT0gRGVzY3JpcHRp b24gPT09DQoNClRoZSBZVVY0MjIgY29udmVyc2lvbiBmdW5jdGlvbnMgcHJvY2VzcyAyIHJvd3Mg YXQgb25jZSBidXQgZGlkIG5vdA0KY2hlY2sgd2hldGhlciBhIHNlY29uZCByb3cgYWN0dWFsbHkg ZXhpc3RzIHdoZW4gc3JjU2xpY2VIIGlzIG9kZC4NCldpdGggYm90dG9tLXRvLXRvcCBwcm9jZXNz aW5nIChuZWdhdGl2ZSBzdHJpZGVzKSwgdGhpcyBjYXVzZWQNCnB1XzIvcHZfMiBwb2ludGVycyB0 byBiZSBzZXQgYmVmb3JlIHRoZSBidWZmZXIgc3RhcnQsIGxlYWRpbmcgdG8NCm91dC1vZi1ib3Vu ZHMgbWVtb3J5IGFjY2VzcyB3aGVuIGFjY2Vzc2luZyBwdV8yWzBdIG9yIHB2XzJbMF0uDQoNClRo aXMgcGF0Y2ggYWRkcyBhIGNoZWNrIHRvIHNraXAgcm93IDIgcHJvY2Vzc2luZyBpbiB0aGUgZmlu YWwNCnJlbWFpbmRlciBzZWN0aW9uIHdoZW4gc3JjU2xpY2VIIGlzIG9kZCwgcHJldmVudGluZyBh Y2Nlc3MgdG8NCm5vbi1leGlzdGVudCByb3dzIHdoaWxlIHN0aWxsIHByb2Nlc3NpbmcgYWxsIGF2 YWlsYWJsZSBzb3VyY2UgbGluZXMuDQoNClBlcmZvcm1hbmNlIGltcGFjdCBpcyBtaW5pbWFsOiBv bmUgYml0d2lzZSBBTkQgb3BlcmF0aW9uIG9ubHkgaW4gdGhlDQpyZW1haW5kZXIgc2VjdGlvbiAo d2hlbiB3aWR0aCBpcyBub3QgZGl2aXNpYmxlIGJ5IDQpLCBzbyBwZXJmb3JtYW5jZQ0KcmVncmVz c2lvbiBpcyB1bmxpa2VseSB0byBiZSBzZXZlcmUuDQoNCkZpeGVzOiBodHRwczovL3RyYWMuZmZt cGVnLm9yZy90aWNrZXQvMTE2OTENCg0K8J+kliBHZW5lcmF0ZWQgd2l0aCBbQ2xhdWRlIENvZGVd KGh0dHBzOi8vY2xhdWRlLmNvbS9jbGF1ZGUtY29kZSkNCg0KQ28tQXV0aG9yZWQtQnk6IENsYXVk ZSA8bm9yZXBseUBhbnRocm9waWMuY29tPgoKCkZyb20gOTViOTZlZmE3YmM3YjU4N2U4NTdiM2U3 ODBkNzJiMTE5MmNiNmE0OSBNb24gU2VwIDE3IDAwOjAwOjAwIDIwMDEKRnJvbTogVGhvbWFzIER1 bGxpZW4gPHRob21hcy5kdWxsaWVuQGdtYWlsLmNvbT4KRGF0ZTogU3VuLCA5IE5vdiAyMDI1IDEy OjE2OjI3ICswMTAwClN1YmplY3Q6IFtQQVRDSF0gc3dzY2FsZS95dXYycmdiOiBmaXggb3V0LW9m LWJvdW5kcyBhY2Nlc3Mgd2l0aCBvZGQgc3JjU2xpY2VICiBpbiBZVVY0MjIKTUlNRS1WZXJzaW9u OiAxLjAKQ29udGVudC1UeXBlOiB0ZXh0L3BsYWluOyBjaGFyc2V0PVVURi04CkNvbnRlbnQtVHJh bnNmZXItRW5jb2Rpbmc6IDhiaXQKClRoZSBZVVY0MjIgY29udmVyc2lvbiBmdW5jdGlvbnMgcHJv Y2VzcyAyIHJvd3MgYXQgb25jZSBidXQgZGlkIG5vdApjaGVjayB3aGV0aGVyIGEgc2Vjb25kIHJv dyBhY3R1YWxseSBleGlzdHMgd2hlbiBzcmNTbGljZUggaXMgb2RkLgpXaXRoIGJvdHRvbS10by10 b3AgcHJvY2Vzc2luZyAobmVnYXRpdmUgc3RyaWRlcyksIHRoaXMgY2F1c2VkCnB1XzIvcHZfMiBw b2ludGVycyB0byBiZSBzZXQgYmVmb3JlIHRoZSBidWZmZXIgc3RhcnQsIGxlYWRpbmcgdG8Kb3V0 LW9mLWJvdW5kcyBtZW1vcnkgYWNjZXNzIHdoZW4gYWNjZXNzaW5nIHB1XzJbMF0gb3IgcHZfMlsw XS4KClRoaXMgcGF0Y2ggYWRkcyBhIGNoZWNrIHRvIHNraXAgcm93IDIgcHJvY2Vzc2luZyBpbiB0 aGUgZmluYWwKcmVtYWluZGVyIHNlY3Rpb24gd2hlbiBzcmNTbGljZUggaXMgb2RkLCBwcmV2ZW50 aW5nIGFjY2VzcyB0bwpub24tZXhpc3RlbnQgcm93cyB3aGlsZSBzdGlsbCBwcm9jZXNzaW5nIGFs bCBhdmFpbGFibGUgc291cmNlIGxpbmVzLgoKUGVyZm9ybWFuY2UgaW1wYWN0IGlzIG1pbmltYWw6 IG9uZSBiaXR3aXNlIEFORCBvcGVyYXRpb24gb25seSBpbiB0aGUKcmVtYWluZGVyIHNlY3Rpb24g KHdoZW4gd2lkdGggaXMgbm90IGRpdmlzaWJsZSBieSA0KSwgc28gcGVyZm9ybWFuY2UKcmVncmVz c2lvbiBpcyB1bmxpa2VseSB0byBiZSBzZXZlcmUuCgpGaXhlczogaHR0cHM6Ly90cmFjLmZmbXBl Zy5vcmcvdGlja2V0LzExNjkxCgrwn6SWIEdlbmVyYXRlZCB3aXRoIFtDbGF1ZGUgQ29kZV0oaHR0 cHM6Ly9jbGF1ZGUuY29tL2NsYXVkZS1jb2RlKQoKQ28tQXV0aG9yZWQtQnk6IENsYXVkZSA8bm9y ZXBseUBhbnRocm9waWMuY29tPgotLS0KIGxpYnN3c2NhbGUveXV2MnJnYi5jIHwgNiArKysrLS0K IDEgZmlsZSBjaGFuZ2VkLCA0IGluc2VydGlvbnMoKyksIDIgZGVsZXRpb25zKC0pCgpkaWZmIC0t Z2l0IGEvbGlic3dzY2FsZS95dXYycmdiLmMgYi9saWJzd3NjYWxlL3l1djJyZ2IuYwppbmRleCA0 ODA4OTc2MGY1Li5jYjViY2ZhYWMyIDEwMDY0NAotLS0gYS9saWJzd3NjYWxlL3l1djJyZ2IuYwor KysgYi9saWJzd3NjYWxlL3l1djJyZ2IuYwpAQCAtMzY0LDggKzM2NCwxMCBAQCBjb25zdCBpbnQg KnN3c19nZXRDb2VmZmljaWVudHMoaW50IGNvbG9yc3BhY2UpCiAgICAgICAgIExPQURDSFJPTUEo MSwgMCk7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcCiAg ICAgICAgIFBVVEZVTkMoMSwgMCwgMCk7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBcCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcCi0gICAgICAgIExPQURDSFJPTUEoMiwg MCk7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcCi0gICAg ICAgIFBVVEZVTkMoMiwgMCwgMCArIDgpOyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICBcCisgICAgICAgIGlmICghKHNyY1NsaWNlSCAmIDEpKSB7ICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcCisgICAgICAgICAgICBMT0FEQ0hST01BKDIs IDApOyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBcCisgICAgICAg ICAgICBQVVRGVU5DKDIsIDAsIDAgKyA4KTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICBcCisgICAgICAgIH0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICBcCiAgICAgRU5EWVVWMlJHQkZVTkMoKQogCiAjZGVm aW5lIExPQURESVRIRVIxNiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFwKLS0g CjIuNDkuMQoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18K ZmZtcGVnLWRldmVsIG1haWxpbmcgbGlzdCAtLSBmZm1wZWctZGV2ZWxAZmZtcGVnLm9yZwpUbyB1 bnN1YnNjcmliZSBzZW5kIGFuIGVtYWlsIHRvIGZmbXBlZy1kZXZlbC1sZWF2ZUBmZm1wZWcub3Jn Cg==