[FFmpeg-devel] [PATCH 1/2] avfilter/edge_template: Fix small inputs with gaussian_blur()

[FFmpeg-devel] [PATCH 1/2] avfilter/edge_template: Fix small inputs with gaussian_blur()

[Michael Niedermayer]

Fixes: out of array access
Fixes: Ticket10699
Fixes: poc5ffmpeg

Found-by: Zeng Yunxiang
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/edge_template.c | 29 +++++++++++++++++++----------
 1 file changed, 19 insertions(+), 10 deletions(-)

diff --git a/libavfilter/edge_template.c b/libavfilter/edge_template.c
index 14635c25af0..ce45e579db5 100644
--- a/libavfilter/edge_template.c
+++ b/libavfilter/edge_template.c
@@ -74,6 +74,7 @@ void fn(gaussian_blur)(int w, int h,
                        uint8_t *dst, int dst_linesize,
                        const uint8_t *src, int src_linesize, int src_stride)
 {
+    int j;
     pixel *srcp = (pixel *)src;
     pixel *dstp = (pixel *)dst;
 
@@ -81,12 +82,17 @@ void fn(gaussian_blur)(int w, int h,
     src_linesize /= sizeof(pixel);
     dst_linesize /= sizeof(pixel);
 
-    memcpy(dstp, srcp, w*sizeof(pixel)); dstp += dst_linesize; srcp += src_linesize;
-    memcpy(dstp, srcp, w*sizeof(pixel)); dstp += dst_linesize; srcp += src_linesize;
-    for (int j = 2; j < h - 2; j++) {
-        dstp[0] = srcp[(0)*src_stride];
-        dstp[1] = srcp[(1)*src_stride];
-        for (int i = 2; i < w - 2; i++) {
+    for (j = 0; j < FFMIN(h, 2); j++) {
+        memcpy(dstp, srcp, w*sizeof(pixel));
+        dstp += dst_linesize;
+        srcp += src_linesize;
+    }
+
+    for (; j < h - 2; j++) {
+        int i;
+        for (i = 0; i < FFMIN(w, 2); i++)
+            dstp[i] = srcp[i*src_stride];
+        for (; i < w - 2; i++) {
             /* Gaussian mask of size 5x5 with sigma = 1.4 */
             dstp[i] = ((srcp[-2*src_linesize + (i-2)*src_stride] + srcp[2*src_linesize + (i-2)*src_stride]) * 2
                      + (srcp[-2*src_linesize + (i-1)*src_stride] + srcp[2*src_linesize + (i-1)*src_stride]) * 4
@@ -106,12 +112,15 @@ void fn(gaussian_blur)(int w, int h,
                      + srcp[(i+1)*src_stride] * 12
                      + srcp[(i+2)*src_stride] *  5) / 159;
         }
-        dstp[w - 2] = srcp[(w - 2)*src_stride];
-        dstp[w - 1] = srcp[(w - 1)*src_stride];
+        for (; i < w; i++)
+            dstp[i] = srcp[i*src_stride];
 
         dstp += dst_linesize;
         srcp += src_linesize;
     }
-    memcpy(dstp, srcp, w*sizeof(pixel)); dstp += dst_linesize; srcp += src_linesize;
-    memcpy(dstp, srcp, w*sizeof(pixel));
+    for (; j < h; j++) {
+        memcpy(dstp, srcp, w*sizeof(pixel));
+        dstp += dst_linesize;
+        srcp += src_linesize;
+    }
 }
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/2] avfilter/vf_weave: Fix odd height handling

[Michael Niedermayer]

Fixes: out of array access
Fixes: tickets/10743/poc10ffmpeg

Found-by: Zeng Yunxiang and Li Zeyuan
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/vf_weave.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/libavfilter/vf_weave.c b/libavfilter/vf_weave.c
index 84f3c5f337d..7ad29bdedbe 100644
--- a/libavfilter/vf_weave.c
+++ b/libavfilter/vf_weave.c
@@ -32,6 +32,7 @@ typedef struct WeaveContext {
     int double_weave;
     int nb_planes;
     int planeheight[4];
+    int outheight[4];
     int linesize[4];
 
     AVFrame *prev;
@@ -81,6 +82,9 @@ static int config_props_output(AVFilterLink *outlink)
     s->planeheight[1] = s->planeheight[2] = AV_CEIL_RSHIFT(inlink->h, desc->log2_chroma_h);
     s->planeheight[0] = s->planeheight[3] = inlink->h;
 
+    s->outheight[1] = s->outheight[2] = AV_CEIL_RSHIFT(2*inlink->h, desc->log2_chroma_h);
+    s->outheight[0] = s->outheight[3] = 2*inlink->h;
+
     s->nb_planes = av_pix_fmt_count_planes(inlink->format);
 
     return 0;
@@ -106,19 +110,20 @@ static int weave_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs)
         const int height = s->planeheight[i];
         const int start = (height * jobnr) / nb_jobs;
         const int end = (height * (jobnr+1)) / nb_jobs;
+        const int compensation = 2*end > s->outheight[i];
 
         av_image_copy_plane(out->data[i] + out->linesize[i] * field1 +
                             out->linesize[i] * start * 2,
                             out->linesize[i] * 2,
                             in->data[i] + start * in->linesize[i],
                             in->linesize[i],
-                            s->linesize[i], end - start);
+                            s->linesize[i], end - start - compensation * field1);
         av_image_copy_plane(out->data[i] + out->linesize[i] * field2 +
                             out->linesize[i] * start * 2,
                             out->linesize[i] * 2,
                             s->prev->data[i] + start * s->prev->linesize[i],
                             s->prev->linesize[i],
-                            s->linesize[i], end - start);
+                            s->linesize[i], end - start - compensation * field2);
     }
 
     return 0;
-- 
2.17.1

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/2] avfilter/edge_template: Fix small inputs with gaussian_blur()

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 584 bytes --]

On Fri, Dec 22, 2023 at 12:51:51PM +0100, Michael Niedermayer wrote:
> Fixes: out of array access
> Fixes: Ticket10699
> Fixes: poc5ffmpeg
> 
> Found-by: Zeng Yunxiang
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavfilter/edge_template.c | 29 +++++++++++++++++++----------
>  1 file changed, 19 insertions(+), 10 deletions(-)

will apply patchset

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

I do not agree with what you have to say, but I'll defend to the death your
right to say it. -- Voltaire

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".