From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id B39CB46F91 for ; Mon, 24 Jul 2023 02:50:03 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 5D2E568C745; Mon, 24 Jul 2023 05:50:00 +0300 (EEST) Received: from NAM10-BN7-obe.outbound.protection.outlook.com (mail-bn7nam10olkn2109.outbound.protection.outlook.com [40.92.40.109]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 8993A68C72C for ; Mon, 24 Jul 2023 05:49:54 +0300 (EEST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=JZokME6TtUF8y1yAlxuasP7s+JdtKMuW4Yp35F6pCv0WD5wDsGdxnA1JoYf0aOXYJCBVCkqCBHj1dwdRluUMLAzxCVp6qXkRyqgwR/MCkUJ1iwAjuwB8nz/hz3e80HmPQTYBi6zpNzIlFLFhTJ9NW6jP+iBTt4TTa0m3C7bkBW4lAQI3UUo3xWpEUbIwSRRPg+xXrUfqUIKjtPnRSBAa7CnHfKjbWf/VOIm5X1ngnbXDekqLgBJKy9elbMD6j0+dekSW16648Wb/abLGdI9u2s7bZdjkoPNnr4pPIaOOZ5VCw5va5tYxRaaUX2lrTrfg9JZS3XqmhMm0LVe45yT7mA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=1evrlduphzEI+e5QUTrsx4NtBEu16EBpoDNm5Ej1U7k=; b=Fz9a+0JIXAeYIIC6xsWtMExdguJFe8gAC2e5JBnC5+kzshklpirS4Ump29YWb1goF/Zq+WOikJT04BRiNhhkvhvQxVr6MSfHMMl/SB1yzatogUEHM4RPiAK9GEEImoLWPheqNboVg6TnA++eGC/yYxz9p4niNBivIH3xypIM+ZJ4cbFZytvsSGBhZemUAmZn0d9B2D4Q1iy53oCje7WDYiSN8kiu3MHz1DlHXq0Tn9JDieI97Pg6SEGuxikkupUbniwxcp21SXjZxQV4H8r8ncsJUYq+WCiXK+ztsasWxpAMzhyOcnAoFzAOzouyaDxg1OJB8a/WuUAr6lZsi86Gaw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none; dkim=none; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outlook.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1evrlduphzEI+e5QUTrsx4NtBEu16EBpoDNm5Ej1U7k=; b=NYmn7ie4VK6mv3zA95u/wERZZ4JUacE8KDt5OnlbXlP5GcB5NCyVHqwW80mNBKkJlvexHY8Pjk8UjoHDNny71kUOip+JY/415kEB5H8WhX4AqeP3yTPC1DnKfodLtPbX8mxV8g1mDnnKR+HdXc8CkMWt4bfzAZn+kqnP3SV2qaS+UQUGqf+F69nOShgL5kyswPEM3KGdKAbhVwDDNpt4dXasavWGpUWjxYK/MjynhPxOd8JYgJ0yfqjuMZcoNYHJbITykJwXXAWjGqJSv7yiD+zMWBzV2V5jZFJIgseSQ1ELDu14P+kfbHtiuk2I9SYRwPxVFKOHPoBETwK3Yq4pWQ== Received: from PH7PR11MB7430.namprd11.prod.outlook.com (2603:10b6:510:274::20) by MW6PR11MB8412.namprd11.prod.outlook.com (2603:10b6:303:23a::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6588.32; Mon, 24 Jul 2023 02:49:51 +0000 Received: from PH7PR11MB7430.namprd11.prod.outlook.com ([fe80::6216:b3a7:a5b2:bd43]) by PH7PR11MB7430.namprd11.prod.outlook.com ([fe80::6216:b3a7:a5b2:bd43%4]) with mapi id 15.20.6609.031; Mon, 24 Jul 2023 02:49:51 +0000 From: hung kuishing To: "ffmpeg-devel@ffmpeg.org" Thread-Topic: [PATCH] libavfilter/vf_stack.c: check input height for avoiding crashed Thread-Index: Adm57MFDw/Sbhl5bSmCiUAZ2hinb+Q== Date: Mon, 24 Jul 2023 02:49:51 +0000 Message-ID: Accept-Language: zh-CN, en-US Content-Language: zh-CN X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-tmn: [jJ6j4mRFc5PgEePZgbxqwhj2JSa3W7kiVyArXEDsct8=] x-ms-publictraffictype: Email x-ms-traffictypediagnostic: PH7PR11MB7430:EE_|MW6PR11MB8412:EE_ x-ms-office365-filtering-correlation-id: 4130fd2f-0b45-43a0-ef16-08db8bf0a73a x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: VrOftpkP7UVoEYRKnOxa/AufLZQ28uTpYlLv0oC3jre8swqaIN+9oQWSUSqXyGSRGRXjYEyo3yWUKwlNSy2tlIGHWSit6GfQQKeErYZMoLmqY7ysV+TN5UFv8DWgt8K1BqsFRnqMrsDtkguJWZ8pOqEWO/5FKrCBhEJ8WSyCj19pTaNpcAPWR0Vspn7a2TWA0Ke+8QvyiE3efEMtfUvPe+0bQn9TZUeed5JxSCxhP4Cgu1yqi6fmyqGbOEe5rUIcTjTwvWFNnZDjR445+Zse3FhmubyFf4Rm1zk2/NavLsirntgdjmm8ltK/mjq42SbWh90R3/x81JPliHlFj344Eh2PqCap20E+q4BnaKA1KGjplGslkg2ufMrikPoUNqc6tTNc7evww9vD//Jql/hrgSUBKiM2OHvLwkBD44GoalMvfGx+5H5Ryh8ruPkONOjd4vonbebAlohLJ24xOgEItGduXAs/np9UNjqjh7EFgO3/xpP2QWzrz4jjlAP1PSqGvf77NTTnBNY/TJYBQprolD3HnUQ4imHhIjVluWaJbWJk8YaVO2VuwWBgmXfTr69H x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?gGZhyheUzrAh2pPRjPM64/eKwfT3W0obuqG66Df1gdwQOyMbcicXkwiL11Vo?= =?us-ascii?Q?iZ63M8rvFfFGuWUegDfzOmKYuD5UqyAP7ywJZLrDdWUNS+vmG6fRzecNLyBL?= =?us-ascii?Q?BvwQxtQgLaEyb+QCWMEZ7/xFt28hq0AiUbFW9ZfwpjZBOQwlJt0K/ozv5uNF?= =?us-ascii?Q?QEV3IMjPXjOAu+Z+mJE8RG8MxXsAz1WOcABjtzL0aXg6E2gzxZDfgbM/sRkp?= =?us-ascii?Q?UWB2NIUtPq2/b0zBck6/wIFU4IihuD0wSsBByJxy/XYC4ZGhXr9/mbjw99fu?= =?us-ascii?Q?bUHKAmy9wN1o+h47CbamZ4rIujsGLf3c5cvduxXqrD6yDmuViamWfXSTKlT6?= =?us-ascii?Q?MzE7XJz69JwynvP1/OEM+rDow5AXpCmALar+XmNl4I8bmrYIQj/4J12xse8M?= =?us-ascii?Q?1Mw4u9U0gM1Tz54d6UsXVT5NiS7MVVqTmQti5QTP0oYS0pCxJHr5rjippshX?= =?us-ascii?Q?H0A+apPbqJFFyIadHQmcaJ7sD+ST85B5stwQfiRcrqUbRLnJF/4SgkUuIXFH?= =?us-ascii?Q?3DmMM8bahQ3novTgLps4qzntQUvPcW4jSTl5A8OBhiJjoOP3GSOIHyp866NG?= =?us-ascii?Q?lawQBt+a21oR8X0nyD+IbawvpwP7MyKwMeIcFva0AU3uJ0+t8axrDWB9+vzK?= =?us-ascii?Q?Ui2Z2ECAklnp5wZ51FShqYujoDwVmLCotJxREVZ+tF7pKit88dBrD3JEIHae?= =?us-ascii?Q?nJPFKyrJ27MD+YWy8m0Mn64rIWU4F1Bq2YUNc6fEqg3atzfD8e6rqEnmdL+s?= =?us-ascii?Q?XEtRfhLEuU5IkNrar9CgXP5YwJI0Muss3KvyMatdSwkUuu4ezmsRNSU7MTft?= =?us-ascii?Q?qEnOJDRCtjuC1O321Nhwrgh96wqhpWOR7jMc+9e52sZfwDVdXLIPPBu77X6r?= =?us-ascii?Q?/yOzkN2YWQWI6sNRsmOzRkZk0JhM5JzbmxrOs9THhJxdQ8Z3fU2+ymRw5xAS?= =?us-ascii?Q?oOdASVqvXxs01nSCIEhCpVYryk6b4qdFcGLx4jIGL5GzqNvy+lYClCKwo9ah?= =?us-ascii?Q?rfoGGIedsMKWB8C4J7cArbHqGjDiZye93wafNTj+twp9LxwHJzq4nxfgXJ68?= =?us-ascii?Q?/La1VQRK2q1h7mC8fcGHopKE7f5lpBsHMEXFDWEi9CfNuBxEuW4o8mngJY6j?= =?us-ascii?Q?1WF60qqWvF7SQHyq5zPFGBm5NIX2HdPNFoivQLhNjhmwJ0ffF4pCWqHw6u6+?= =?us-ascii?Q?YrjxXidVSXVmmHoUtGARM0gE8BJdkNYZNcMsnQ=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: PH7PR11MB7430.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-CrossTenant-Network-Message-Id: 4130fd2f-0b45-43a0-ef16-08db8bf0a73a X-MS-Exchange-CrossTenant-rms-persistedconsumerorg: 00000000-0000-0000-0000-000000000000 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jul 2023 02:49:51.6992 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW6PR11MB8412 Subject: [FFmpeg-devel] [PATCH] libavfilter/vf_stack.c: check input height for avoiding crashed X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: In the case of vertical layout, if the chroma height is ceil rounded when shifted to the right, the total height of the chroma input will be greater than the output height, and a crash occurs. So make sure that the luma height can be shifted to the right to get an integer chroma height Signed-off-by: clarkh --- libavfilter/vf_stack.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/libavfilter/vf_stack.c b/libavfilter/vf_stack.c index 331dc7b3e3..877867938f 100644 --- a/libavfilter/vf_stack.c +++ b/libavfilter/vf_stack.c @@ -220,6 +220,11 @@ static int config_output(AVFilterLink *outlink) return ret; } + if (inlink->h % (1 << s->desc->log2_chroma_h)) { + av_log(ctx, AV_LOG_ERROR, "Input %d height %d does not divisible by %d\n", i, inlink->h, (1 << s->desc->log2_chroma_h)); + return AVERROR(EINVAL); + } + item->height[1] = item->height[2] = AV_CEIL_RSHIFT(inlink->h, s->desc->log2_chroma_h); item->height[0] = item->height[3] = inlink->h; @@ -278,6 +283,11 @@ static int config_output(AVFilterLink *outlink) return ret; } + if ((s->nb_grid_rows > 1) && (inlink->h % (1 << s->desc->log2_chroma_h))) { + av_log(ctx, AV_LOG_ERROR, "Input %d height %d does not divisible by %d\n", k, inlink->h, (1 << s->desc->log2_chroma_h)); + return AVERROR(EINVAL); + } + item->height[1] = item->height[2] = AV_CEIL_RSHIFT(inlink->h, s->desc->log2_chroma_h); item->height[0] = item->height[3] = inlink->h; @@ -302,6 +312,7 @@ static int config_output(AVFilterLink *outlink) char *arg2, *p2, *saveptr2 = NULL; char *arg3, *p3, *saveptr3 = NULL; int inw, inh, size; + int is_multi_row = av_strnstr(s->layout, "h0", strlen(s->layout)) != NULL; if (s->fillcolor_enable) { ff_draw_init(&s->draw, ctx->inputs[0]->format, 0); @@ -321,6 +332,11 @@ static int config_output(AVFilterLink *outlink) return ret; } + if (is_multi_row && (inlink->h % (1 << s->desc->log2_chroma_h))) { + av_log(ctx, AV_LOG_ERROR, "Input %d height %d does not divisible by %d\n", i, inlink->h, (1 << s->desc->log2_chroma_h)); + return AVERROR(EINVAL); + } + item->height[1] = item->height[2] = AV_CEIL_RSHIFT(inlink->h, s->desc->log2_chroma_h); item->height[0] = item->height[3] = inlink->h; -- 2.34.1 _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".