From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id B57324F405 for ; Wed, 25 Feb 2026 00:00:36 +0000 (UTC) Authentication-Results: ffbox; dkim=fail (body hash mismatch (got b'dPxb1TjDeOHUgBe/QNkMoz8sfSxguvKVSyvmrLzNmcg=', expected b'6LsuFcU7ByQzZIjsbetm1vk0ZxO2K6gmt0ECt9yshvs=')) header.d=ffmpeg.org header.i=@ffmpeg.org header.a=rsa-sha256 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1771977349; h=mime-version : to : date : message-id : reply-to : subject : list-id : list-archive : list-archive : list-help : list-owner : list-post : list-subscribe : list-unsubscribe : from : cc : content-type : content-transfer-encoding : from; bh=dPxb1TjDeOHUgBe/QNkMoz8sfSxguvKVSyvmrLzNmcg=; b=k42CabqpqlyCr3rZGKKCnkuwBD+DhnRM5a6JKaGpq4sR+mT8sqzjg+enjTf7a3xhWWJev PYoFAewQof/jSJhAmHb/kt1lWjy3sZu3eLT4hK5DfUs+yZ8sVpeCii4EX1lzxe+FowcQJaC K+7rFMv1rWoWz04/Q7qobo9r1a205u534rhjx/WwkUl/CfVwwwyW8gEhB9BxvOPkl4aq6Mx KCisKgECcxIs7aVJb2zpsXoQMDKgSA5M9w/tf7qZEuF3h85GfvJqAZbzHcWEYRkSgWNJSQE T0wWse/5jIifny5x3DBBvgM762FBJddsYyfCVrmDU3a4B8zBtsvxPgcbi2ag== Received: from [172.18.0.3] (unknown [172.18.0.3]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id AB49E691A8B; Wed, 25 Feb 2026 01:55:49 +0200 (EET) ARC-Seal: i=1; cv=none; a=rsa-sha256; d=ffmpeg.org; s=arc; t=1771977336; b=Uys6DDr1GaSQgTuebGq0UzGTHp+iNSj4nQmuibpbNPeTkWxpPf5R1i5x33UohhdXtvnfD MNGwp+l8cTHkIhAzAOhis/Kc2ad7VAs8LyXIibUHoWYEqJRl1FTqakvQKs1tg2zFUKxOfQM D3eo4FKjFVw6rWcMNIVL6i4kj5d++l1I+E+HZx6hWwqcxnqEkgpL7lq3U12GmJxspO32I6o Ccgjw89drTSEKJB5y+jRzdVg6HcEk06pkxOn/+GB4wR40OVkjG9GnFM8dDuQ8Fp+w3R+Okh q3y0/cN7h5WvVUKDCshswgngGWc6iwMaEOix3JOUx4PzBxVPsH1Fg2iGIfug== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=ffmpeg.org; s=arc; t=1771977336; h=from : sender : reply-to : subject : date : message-id : to : cc : mime-version : content-type : content-transfer-encoding : content-id : content-description : resent-date : resent-from : resent-sender : resent-to : resent-cc : resent-message-id : in-reply-to : references : list-id : list-help : list-unsubscribe : list-subscribe : list-post : list-owner : list-archive; bh=89w1pp3QJc22bscdkyFXOqNK7eNojOjT4lc8kLd33bg=; b=C/RGDq2r3iG5wvudAX/wLeEyqrwQfRqg+s/lAbIK2y/twvsReuNi56k1QMSxtJ6ipNVxm MZcFQp0daV+NJcEzMHzKGECk8DaoCxr4G7KITmeSWagzI70hGqchJADng70SPgpn4qz04iG usfT82jAWJ1oqzHR4WhefiVOnefQbhuNyYz+lYiGz1U2Lr2hVpAqThcidApF8LsrF4Jp9Mt EnXDQsyMw7SZEFkaU7HE1i0dHDO8G1neoMJeU4ba1u92Q+GItrkD5awc7NtlXLc86xVKVUq /HmrTTp5y5IhnOM8QNo8FjHkLE8SpaUZPXKv0lKAIa6gv7tLak2vE/EtKZ8Q== ARC-Authentication-Results: i=1; ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none; dmarc=pass header.from=ffmpeg.org policy.dmarc=quarantine Authentication-Results: ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none (Message is not ARC signed); dmarc=pass (Used From Domain Record) header.from=ffmpeg.org policy.dmarc=quarantine DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1771977326; h=content-type : mime-version : content-transfer-encoding : from : to : reply-to : subject : date : from; bh=6LsuFcU7ByQzZIjsbetm1vk0ZxO2K6gmt0ECt9yshvs=; b=CoB9oGVnGU3XktXnYj4RHzpL81BVGdNPHxhCECQesM99aaoXzu8dv47En8ophFVGq5XJu tju9HU355kEjDk1MWjePKC3a/el8pojDQzLcOnPZD1/s/I1dOOH0jj6smzWnv8UnwCbUq+n tbnhkE8eYfUruoUPlpUQh3ReRybXU7JqMiao7Xq97DHqjRGpIBALsrBZ1LB+KQ1qnVjVszB 4SA3SYfc/qP9gARy8pGQJSFXKYf9Q8bIb++oJR4VrouwpcWVldaU2NWzTwSMXmISFsk0bDp J9hBfcG9/wctU3uIZsaO5syyu7Fby8mDn91KVCihN3btbtrpBcWOwQC8pyOg== MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Date: Tue, 24 Feb 2026 23:55:26 -0000 Message-ID: <177197732667.25.6072045881924448353@29965ddac10e> Message-ID-Hash: LRONOZT73P55DKNBFG2GZMB3P2FCXKPX X-Message-ID-Hash: LRONOZT73P55DKNBFG2GZMB3P2FCXKPX X-MailFrom: code@ffmpeg.org X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-ffmpeg-devel.ffmpeg.org-0; header-match-ffmpeg-devel.ffmpeg.org-1; header-match-ffmpeg-devel.ffmpeg.org-2; header-match-ffmpeg-devel.ffmpeg.org-3; emergency; member-moderation X-Mailman-Version: 3.3.10 Precedence: list Reply-To: FFmpeg development discussions and patches Subject: [FFmpeg-devel] [PR] avfilter/vf_convolution: Handle corner cases with small frames (PR #22281) List-Id: FFmpeg development discussions and patches Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: michaelni via ffmpeg-devel Cc: michaelni Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Archived-At: List-Archive: List-Post: PR #22281 opened by michaelni URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22281 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/22281.patch Fixes: out of array read Fixes: #YWH-PGM40646-35 Found-by: jpraveenrao Signed-off-by: Michael Niedermayer >>From 774e03931cda201589b0280348ec16123297315e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 24 Feb 2026 23:37:21 +0100 Subject: [PATCH 1/2] avfilter/vf_convolution: Use avpriv_mirror Fixes: out of array read Fixes: #YWH-PGM40646-35 Found-by: jpraveenrao Signed-off-by: Michael Niedermayer --- libavfilter/convolution.h | 8 +++----- libavfilter/vf_convolution.c | 22 ++++++---------------- 2 files changed, 9 insertions(+), 21 deletions(-) diff --git a/libavfilter/convolution.h b/libavfilter/convolution.h index f88b708fab..71ec3b6804 100644 --- a/libavfilter/convolution.h +++ b/libavfilter/convolution.h @@ -21,6 +21,7 @@ #ifndef AVFILTER_CONVOLUTION_H #define AVFILTER_CONVOLUTION_H #include "avfilter.h" +#include "libavutil/internal.h" #include "libavutil/intreadwrite.h" enum MatrixMode { @@ -71,11 +72,8 @@ static void setup_3x3(int radius, const uint8_t *c[], const uint8_t *src, int st int i; for (i = 0; i < 9; i++) { - int xoff = FFABS(x + ((i % 3) - 1)); - int yoff = FFABS(y + (i / 3) - 1); - - xoff = xoff >= w ? 2 * w - 1 - xoff : xoff; - yoff = yoff >= h ? 2 * h - 1 - yoff : yoff; + int xoff = avpriv_mirror(x + (i % 3) - 1, w - 1); + int yoff = avpriv_mirror(y + (i / 3) - 1, h - 1); c[i] = src + xoff * bpc + yoff * stride; } diff --git a/libavfilter/vf_convolution.c b/libavfilter/vf_convolution.c index ce42df2cde..f0d2cec78e 100644 --- a/libavfilter/vf_convolution.c +++ b/libavfilter/vf_convolution.c @@ -520,11 +520,8 @@ static void setup_5x5(int radius, const uint8_t *c[], const uint8_t *src, int st int i; for (i = 0; i < 25; i++) { - int xoff = FFABS(x + ((i % 5) - 2)); - int yoff = FFABS(y + (i / 5) - 2); - - xoff = xoff >= w ? 2 * w - 1 - xoff : xoff; - yoff = yoff >= h ? 2 * h - 1 - yoff : yoff; + int xoff = avpriv_mirror(x + (i % 5) - 2, w - 1); + int yoff = avpriv_mirror(y + (i / 5) - 2, h - 1); c[i] = src + xoff * bpc + yoff * stride; } @@ -536,11 +533,8 @@ static void setup_7x7(int radius, const uint8_t *c[], const uint8_t *src, int st int i; for (i = 0; i < 49; i++) { - int xoff = FFABS(x + ((i % 7) - 3)); - int yoff = FFABS(y + (i / 7) - 3); - - xoff = xoff >= w ? 2 * w - 1 - xoff : xoff; - yoff = yoff >= h ? 2 * h - 1 - yoff : yoff; + int xoff = avpriv_mirror(x + (i % 7) - 3, w - 1); + int yoff = avpriv_mirror(y + (i / 7) - 3, h - 1); c[i] = src + xoff * bpc + yoff * stride; } @@ -552,9 +546,7 @@ static void setup_row(int radius, const uint8_t *c[], const uint8_t *src, int st int i; for (i = 0; i < radius * 2 + 1; i++) { - int xoff = FFABS(x + i - radius); - - xoff = xoff >= w ? 2 * w - 1 - xoff : xoff; + int xoff = avpriv_mirror(x + i - radius, w - 1); c[i] = src + xoff * bpc + y * stride; } @@ -566,9 +558,7 @@ static void setup_column(int radius, const uint8_t *c[], const uint8_t *src, int int i; for (i = 0; i < radius * 2 + 1; i++) { - int xoff = FFABS(x + i - radius); - - xoff = xoff >= h ? 2 * h - 1 - xoff : xoff; + int xoff = avpriv_mirror(x + i - radius, h - 1); c[i] = src + y * bpc + xoff * stride; } -- 2.52.0 >>From 1a7468b9a240da0c7d5ec0adcf0f637a247f91f4 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 25 Feb 2026 00:44:41 +0100 Subject: [PATCH 2/2] avfilter/vf_convolution: Handle corner cases with small frames Fixes: out of array read Fixes: #YWH-PGM40646-35 Found-by: jpraveenrao Signed-off-by: Michael Niedermayer --- libavfilter/vf_convolution.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/libavfilter/vf_convolution.c b/libavfilter/vf_convolution.c index f0d2cec78e..7a27bdba20 100644 --- a/libavfilter/vf_convolution.c +++ b/libavfilter/vf_convolution.c @@ -604,10 +604,12 @@ static int filter_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) continue; } for (y = slice_start; y < slice_end; y += step) { - const int xoff = mode == MATRIX_COLUMN ? (y - slice_start) * bpc : radius * bpc; - const int yoff = mode == MATRIX_COLUMN ? radius * dstride : 0; + const int left = FFMIN(radius, sizew); + const int right = FFMAX(left, sizew - radius); + const int xoff = mode == MATRIX_COLUMN ? (y - slice_start) * bpc : left * bpc; + const int yoff = mode == MATRIX_COLUMN ? left * dstride : 0; - for (x = 0; x < radius; x++) { + for (x = 0; x < left; x++) { const int xoff = mode == MATRIX_COLUMN ? (y - slice_start) * bpc : x * bpc; const int yoff = mode == MATRIX_COLUMN ? x * dstride : 0; @@ -616,11 +618,11 @@ static int filter_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs) bias, matrix, c, s->max, radius, dstride, stride, slice_end - step); } - s->setup[plane](radius, c, src, stride, radius, width, y, height, bpc); - s->filter[plane](dst + yoff + xoff, sizew - 2 * radius, + s->setup[plane](radius, c, src, stride, left, width, y, height, bpc); + s->filter[plane](dst + yoff + xoff, right - left, rdiv, bias, matrix, c, s->max, radius, dstride, stride, slice_end - step); - for (x = sizew - radius; x < sizew; x++) { + for (x = right; x < sizew; x++) { const int xoff = mode == MATRIX_COLUMN ? (y - slice_start) * bpc : x * bpc; const int yoff = mode == MATRIX_COLUMN ? x * dstride : 0; -- 2.52.0 _______________________________________________ ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org