[FFmpeg-devel] [PR] libavfilter/showcwt: fix OOB write for DU/RL position init (PR #21498)

[FFmpeg-devel] [PR] libavfilter/showcwt: fix OOB write for DU/RL position init (PR #21498)

[ruikai via ffmpeg-devel]

PR #21498 opened by ruikai
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21498
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21498.patch

In config_output() for direction=DU/RL, the position
is initialized to s->sono_size, which equals h or w
when bar=0. That position is later used as an
in-bounds pixel coordinate without clamping in draw(),
causing writes past the end of the output planes.

Repro:
```
ffmpeg -f lavfi -i sine=frequency=1000:sample_rate=44100 \
  -filter_complex "[0:a]showcwt=s=640x512:bar=0:direction=du[v]" \
  -map "[v]" -frames:v 1 -f null -
```

AddressSanitizer: `heap-buffer-overflow ... WRITE of size 1`

Initialize and wrap the DU/RL position to sono_size - 1
(or 0 when empty), preventing out-of-bounds row/column
writes when bar=0 while preserving existing slide behavior.


>From 933c5c48cfa9cd66fd655beb123c3fee1b18ddac Mon Sep 17 00:00:00 2001
From: Ruikai Peng <ruikai@pwno.io>
Date: Fri, 16 Jan 2026 22:32:35 -0500
Subject: [PATCH] libavfilter/showcwt: fix OOB write for DU/RL position init

In config_output() for direction=DU/RL, the position
is initialized to s->sono_size, which equals h or w
when bar=0. That position is later used as an
in-bounds pixel coordinate without clamping in draw(),
causing writes past the end of the output planes.

Repro:
ffmpeg -f lavfi -i sine=frequency=1000:sample_rate=44100 \
  -filter_complex "[0:a]showcwt=s=640x512:bar=0:direction=du[v]" \
  -map "[v]" -frames:v 1 -f null -

AddressSanitizer: heap-buffer-overflow ... WRITE of size 1

Initialize and wrap the DU/RL position to sono_size - 1
(or 0 when empty), preventing out-of-bounds row/column
writes when bar=0 while preserving existing slide behavior.
---
 libavfilter/avf_showcwt.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/libavfilter/avf_showcwt.c b/libavfilter/avf_showcwt.c
index 8edf2fb43b..37cbf5514b 100644
--- a/libavfilter/avf_showcwt.c
+++ b/libavfilter/avf_showcwt.c
@@ -1012,7 +1012,7 @@ static int config_output(AVFilterLink *outlink)
         break;
     case DIRECTION_RL:
     case DIRECTION_DU:
-        s->pos = s->sono_size;
+        s->pos = FFMAX(s->sono_size - 1, 0);
         break;
     }
 
@@ -1087,7 +1087,7 @@ static int output_frame(AVFilterContext *ctx)
         case DIRECTION_RL:
             s->pos--;
             if (s->pos < 0) {
-                s->pos = s->sono_size;
+                s->pos = FFMAX(s->sono_size - 1, 0);
                 s->new_frame = 1;
             }
             break;
@@ -1101,7 +1101,7 @@ static int output_frame(AVFilterContext *ctx)
         case DIRECTION_DU:
             s->pos--;
             if (s->pos < 0) {
-                s->pos = s->sono_size;
+                s->pos = FFMAX(s->sono_size - 1, 0);
                 s->new_frame = 1;
             }
             break;
@@ -1115,7 +1115,7 @@ static int output_frame(AVFilterContext *ctx)
             break;
         case DIRECTION_RL:
         case DIRECTION_DU:
-            s->pos = s->sono_size;
+            s->pos = FFMAX(s->sono_size - 1, 0);
             break;
         }
         break;
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org