[FFmpeg-devel] [PATCH] avcodec/yuv4enc: do not read past end of input in case of odd height

[FFmpeg-devel] [PATCH] avcodec/yuv4enc: do not read past end of input in case of odd height

[Paul B Mahol]

[-- Attachment #1: Type: text/plain, Size: 10 bytes --]

Attached.

[-- Attachment #2: 0001-avcodec-yuv4enc-do-not-read-past-end-of-input-in-cas.patch --]
[-- Type: text/x-patch, Size: 1383 bytes --]

From 8295be1415649255b26cfdb0308d7be208711b4d Mon Sep 17 00:00:00 2001
From: Paul B Mahol <onemda@gmail.com>
Date: Wed, 6 Sep 2023 02:27:56 +0200
Subject: [PATCH] avcodec/yuv4enc: do not read past end of input in case of odd
 height

Signed-off-by: Paul B Mahol <onemda@gmail.com>
---
 libavcodec/yuv4enc.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/libavcodec/yuv4enc.c b/libavcodec/yuv4enc.c
index 8123260d5d..dd1874ff25 100644
--- a/libavcodec/yuv4enc.c
+++ b/libavcodec/yuv4enc.c
@@ -41,7 +41,7 @@ static int yuv4_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
     u = pic->data[1];
     v = pic->data[2];
 
-    for (i = 0; i < avctx->height + 1 >> 1; i++) {
+    for (i = 0; i < avctx->height >> 1; i++) {
         for (j = 0; j < avctx->width + 1 >> 1; j++) {
             *dst++ = u[j] ^ 0x80;
             *dst++ = v[j] ^ 0x80;
@@ -55,6 +55,17 @@ static int yuv4_encode_frame(AVCodecContext *avctx, AVPacket *pkt,
         v +=     pic->linesize[2];
     }
 
+    if (avctx->height & 1) {
+        for (j = 0; j < avctx->width + 1 >> 1; j++) {
+            *dst++ = u[j] ^ 0x80;
+            *dst++ = v[j] ^ 0x80;
+            *dst++ = y[2 * j    ];
+            *dst++ = y[2 * j + 1];
+            *dst++ = y[2 * j    ];
+            *dst++ = y[2 * j + 1];
+        }
+    }
+
     *got_packet = 1;
     return 0;
 }
-- 
2.39.1


[-- Attachment #3: Type: text/plain, Size: 251 bytes --]

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] avcodec/yuv4enc: do not read past end of input in case of odd height

[Tomas Härdin]

ons 2023-09-06 klockan 02:35 +0200 skrev Paul B Mahol:
> +    if (avctx->height & 1) {
> +        for (j = 0; j < avctx->width + 1 >> 1; j++) {

Don't we usually wrap shifted expressions in parentheses? I know >> is
lower presedence than + (a wtf in itself tbh) but I seem to recall
parens being the norm in much of the codebase.

/Tomas
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] avcodec/yuv4enc: do not read past end of input in case of odd height

[Anton Khirnov]

Quoting Tomas Härdin (2023-09-06 08:16:12)
> ons 2023-09-06 klockan 02:35 +0200 skrev Paul B Mahol:
> > +    if (avctx->height & 1) {
> > +        for (j = 0; j < avctx->width + 1 >> 1; j++) {
> 
> Don't we usually wrap shifted expressions in parentheses? I know >> is
> lower presedence than + (a wtf in itself tbh) but I seem to recall
> parens being the norm in much of the codebase.

Using ">> 1" to mean "/ 2" is a relic from the days of non-optimizing
compilers anyway.

-- 
Anton Khirnov
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".

Re: [FFmpeg-devel] [PATCH] avcodec/yuv4enc: do not read past end of input in case of odd height

[Andreas Rheinhardt]

Anton Khirnov:
> Quoting Tomas Härdin (2023-09-06 08:16:12)
>> ons 2023-09-06 klockan 02:35 +0200 skrev Paul B Mahol:
>>> +    if (avctx->height & 1) {
>>> +        for (j = 0; j < avctx->width + 1 >> 1; j++) {
>>
>> Don't we usually wrap shifted expressions in parentheses? I know >> is
>> lower presedence than + (a wtf in itself tbh) but I seem to recall
>> parens being the norm in much of the codebase.
> 
> Using ">> 1" to mean "/ 2" is a relic from the days of non-optimizing
> compilers anyway.
> 

Incorrect for signed expressions (right shift rounds to -inf, division
to zero).

- Andreas

_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel

To unsubscribe, visit link above, or email
ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".