[FFmpeg-devel] [PR] avfilter/vf_find_rect: Fix handling odd sized images (PR #21409)

[michaelni via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #21409 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21409
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21409.patch

Fixes: out of array read
Fixes: #YWH-PGM40646-17

Found-by: An0n99X
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


>From 6a0822317a3e60c9c8611dc47bc1ea09c89d0657 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 7 Jan 2026 20:48:34 +0100
Subject: [PATCH] avfilter/vf_find_rect: Fix handling odd sized images

Fixes: out of array read
Fixes: #YWH-PGM40646-17

Found-by: An0n99X
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/vf_find_rect.c | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/libavfilter/vf_find_rect.c b/libavfilter/vf_find_rect.c
index 037be36fc5..b0be1a6f11 100644
--- a/libavfilter/vf_find_rect.c
+++ b/libavfilter/vf_find_rect.c
@@ -80,8 +80,10 @@ static AVFrame *downscale(AVFrame *in)
     src = in   ->data[0];
     dst = frame->data[0];
 
-    for(y = 0; y < frame->height; y++) {
-        for(x = 0; x < frame->width; x++) {
+    int w2 = in->width/2;
+    int h2 = in->height/2;
+    for(y = 0; y < h2; y++) {
+        for(x = 0; x < w2; x++) {
             dst[x] = (  src[2*x+0]
                       + src[2*x+1]
                       + src[2*x+0 + in->linesize[0]]
@@ -91,6 +93,22 @@ static AVFrame *downscale(AVFrame *in)
         src += 2*in->linesize[0];
         dst += frame->linesize[0];
     }
+    src = in   ->data[0];
+    dst = frame->data[0];
+    for(y = 0; y < frame->height; y++) {
+        int yd = y < h2 ? in->linesize[0] : 0;
+        x = yd ? w2 : 0;
+        for(; x < frame->width; x++) {
+            dst[x] = (  src[2*x+0]
+                      + src[FFMIN(2*x+1, w2)]
+                      + src[2*x+0            + yd]
+                      + src[FFMIN(2*x+1, w2) + yd]
+                      + 2) >> 2;
+        }
+        src += 2*in->linesize[0];
+        dst += frame->linesize[0];
+    }
+
     return frame;
 }
 
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org