[FFmpeg-devel] [PATCH 1/3] avfilter/vf_avgblur_opencl: Use AV_VIDEO_MAX_PLANES

[FFmpeg-devel] [PATCH 1/3] avfilter/vf_avgblur_opencl: Use AV_VIDEO_MAX_PLANES

[Michael Niedermayer]

Fixes: CID1437470 Out-of-bounds read (out of bounds read would only occur with a pixel format of more than 4 planes)

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/vf_avgblur_opencl.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/libavfilter/vf_avgblur_opencl.c b/libavfilter/vf_avgblur_opencl.c
index c00d2f6363c..ad68b8be385 100644
--- a/libavfilter/vf_avgblur_opencl.c
+++ b/libavfilter/vf_avgblur_opencl.c
@@ -47,8 +47,8 @@ typedef struct AverageBlurOpenCLContext {
     FilterParam luma_param;
     FilterParam chroma_param;
     FilterParam alpha_param;
-    int radius[4];
-    int power[4];
+    int radius[AV_VIDEO_MAX_PLANES];
+    int power[AV_VIDEO_MAX_PLANES];
 
 } AverageBlurOpenCLContext;
 
@@ -101,7 +101,7 @@ static int avgblur_opencl_make_filter_params(AVFilterLink *inlink)
         s->radiusV = s->radiusH;
     }
 
-    for (i = 0; i < 4; i++) {
+    for (i = 0; i < AV_VIDEO_MAX_PLANES; i++) {
         s->power[i] = 1;
     }
     return 0;
@@ -133,7 +133,7 @@ static int boxblur_opencl_make_filter_params(AVFilterLink *inlink)
     s->power[U] = s->power[V] = s->chroma_param.power;
     s->power[A] = s->alpha_param.power;
 
-    for (i = 0; i < 4; i++) {
+    for (i = 0; i < AV_VIDEO_MAX_PLANES; i++) {
         if (s->power[i] == 0) {
             s->power[i] = 1;
             s->radius[i] = 0;
@@ -191,7 +191,7 @@ static int avgblur_opencl_filter_frame(AVFilterLink *inlink, AVFrame *input)
         goto fail;
     }
 
-    for (p = 0; p < FF_ARRAY_ELEMS(output->data); p++) {
+    for (p = 0; p < FFMIN(FF_ARRAY_ELEMS(output->data), AV_VIDEO_MAX_PLANES); p++) {
         src = (cl_mem) input->data[p];
         dst = (cl_mem) output->data[p];
         inter = (cl_mem)intermediate->data[p];
-- 
2.45.2

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 2/3] avfilter/vf_bm3d: Dont round MSE2SSE to an integer

[Michael Niedermayer]

Fixes: CID1439581 Result is not floating-point

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/vf_bm3d.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavfilter/vf_bm3d.c b/libavfilter/vf_bm3d.c
index f53a206b518..eb7f6d34d99 100644
--- a/libavfilter/vf_bm3d.c
+++ b/libavfilter/vf_bm3d.c
@@ -274,7 +274,7 @@ static void do_block_matching_multi(BM3DContext *s, const uint8_t *src, int src_
                                     int r_y, int r_x, int plane, int jobnr)
 {
     SliceContext *sc = &s->slices[jobnr];
-    double MSE2SSE = s->group_size * s->block_size * s->block_size * src_range * src_range / (s->max * s->max);
+    double MSE2SSE = s->group_size * s->block_size * s->block_size * src_range * src_range / (double)(s->max * s->max);
     double distMul = 1. / MSE2SSE;
     double th_sse = th_mse * MSE2SSE;
     int index = sc->nb_match_blocks;
-- 
2.45.2

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

[FFmpeg-devel] [PATCH 3/3] avfilter/vf_convolution_opencl: Assert that the filter name is one of the filters

[Michael Niedermayer]

Helps with: CID1439572 Uninitialized pointer read

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavfilter/vf_convolution_opencl.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavfilter/vf_convolution_opencl.c b/libavfilter/vf_convolution_opencl.c
index 0eff9f40d3b..40938436f2b 100644
--- a/libavfilter/vf_convolution_opencl.c
+++ b/libavfilter/vf_convolution_opencl.c
@@ -20,6 +20,7 @@
 
 #include "config_components.h"
 
+#include "libavutil/avassert.h"
 #include "libavutil/common.h"
 #include "libavutil/imgutils.h"
 #include "libavutil/mem.h"
@@ -80,6 +81,8 @@ static int convolution_opencl_init(AVFilterContext *avctx)
         kernel_name = "prewitt_global";
     } else if (!strcmp(avctx->filter->name, "roberts_opencl")){
         kernel_name = "roberts_global";
+    } else {
+        av_assert0(0);
     }
     ctx->kernel = clCreateKernel(ctx->ocf.program, kernel_name, &cle);
     CL_FAIL_ON_ERROR(AVERROR(EIO), "Failed to create "
-- 
2.45.2

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH 1/3] avfilter/vf_avgblur_opencl: Use AV_VIDEO_MAX_PLANES

[Michael Niedermayer]

[-- Attachment #1.1: Type: text/plain, Size: 583 bytes --]

On Thu, Jun 13, 2024 at 12:22:09AM +0200, Michael Niedermayer wrote:
> Fixes: CID1437470 Out-of-bounds read (out of bounds read would only occur with a pixel format of more than 4 planes)
> 
> Sponsored-by: Sovereign Tech Fund
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavfilter/vf_avgblur_opencl.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)

will apply patchset

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

No snowflake in an avalanche ever feels responsible. -- Voltaire

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".