[FFmpeg-devel] Re: [PATCH] qsv: fix pitch truncation on negative/oversized stride

[Zhao Zhili via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

> On Nov 18, 2025, at 09:26, Xiang, Haihao via ffmpeg-devel <ffmpeg-devel@ffmpeg.org> wrote:
> 
> From: Disclosure <disclosure@aisle.com>
> 
> Reviewed-by: Zhong Li <lizhong1008@gmail.com>
> Reviewed-by: Haihao Xiang <haihao.xiang@intel.com>
> Cc: Michael Niedermayer <michael@niedermayer.cc>
> Signed-off-by: Disclosure <disclosure@aisle.com>
> ---
> libavcodec/qsv.c          |  2 ++
> libavfilter/qsvvpp.c      |  2 ++
> libavutil/hwcontext_qsv.c | 20 ++++++++++++++------
> 3 files changed, 18 insertions(+), 6 deletions(-)
> 
> diff --git a/libavcodec/qsv.c b/libavcodec/qsv.c
> index cd5195a54b..cc67e2110e 100644
> --- a/libavcodec/qsv.c
> +++ b/libavcodec/qsv.c
> @@ -340,6 +340,8 @@ int ff_qsv_map_frame_to_surface(const AVFrame *frame, mfxFrameSurface1 *surface)
>     default:
>         return AVERROR(ENOSYS);
>     }
> +    if (frame->linesize[0] <= 0 || frame->linesize[0] > UINT16_MAX)
> +	return AVERROR(EINVAL);

linesize[0] < 0 is valid for FFmpeg, although I don’t know whether it can or should be supported at here.

>     surface->Data.PitchLow  = frame->linesize[0];
> 
>     return 0;
> diff --git a/libavfilter/qsvvpp.c b/libavfilter/qsvvpp.c
> index c3685f126c..24e4431f75 100644
> --- a/libavfilter/qsvvpp.c
> +++ b/libavfilter/qsvvpp.c
> @@ -289,6 +289,8 @@ static int map_frame_to_surface(AVFrame *frame, mfxFrameSurface1 *surface)
>     default:
>         return MFX_ERR_UNSUPPORTED;
>     }
> +    if (frame->linesize[0] <= 0 || frame->linesize[0] > UINT16_MAX)
> +	return AVERROR(EINVAL);
>     surface->Data.Pitch = frame->linesize[0];
> 
>     return 0;
> diff --git a/libavutil/hwcontext_qsv.c b/libavutil/hwcontext_qsv.c
> index b92c9cb0ad..7e33d9c1f8 100644
> --- a/libavutil/hwcontext_qsv.c
> +++ b/libavutil/hwcontext_qsv.c
> @@ -1784,6 +1784,8 @@ static int map_frame_to_surface(const AVFrame *frame, mfxFrameSurface1 *surface)
>     default:
>         return MFX_ERR_UNSUPPORTED;
>     }
> +    if (frame->linesize[0] <= 0 || frame->linesize[0] > UINT16_MAX)
> +	return AVERROR(EINVAL);
>     surface->Data.Pitch     = frame->linesize[0];
>     surface->Data.TimeStamp = frame->pts;
> 
> @@ -1838,15 +1840,16 @@ static int qsv_transfer_data_from(AVHWFramesContext *ctx, AVFrame *dst,
>     /* According to MSDK spec for mfxframeinfo, "Width must be a multiple of 16.
>      * Height must be a multiple of 16 for progressive frame sequence and a
>      * multiple of 32 otherwise.", so align all frames to 16 before downloading. */
> -    if (dst->height & 15 || dst->linesize[0] & 15) {
> +    if (dst->height & 15 || dst->linesize[0] & 15 ||
> +        dst->linesize[0] <= 0 || dst->linesize[0] > UINT16_MAX) {
>         realigned = 1;
>         if (tmp_frame->format != dst->format ||
> -            tmp_frame->width  != FFALIGN(dst->linesize[0], 16) ||
> +            tmp_frame->width  != FFALIGN(FFABS(dst->linesize[0]), 16) ||
>             tmp_frame->height != FFALIGN(dst->height, 16)) {
>             av_frame_unref(tmp_frame);
> 
>             tmp_frame->format = dst->format;
> -            tmp_frame->width  = FFALIGN(dst->linesize[0], 16);
> +            tmp_frame->width  = FFALIGN(FFABS(dst->linesize[0]), 16);
>             tmp_frame->height = FFALIGN(dst->height, 16);
>             ret = av_frame_get_buffer(tmp_frame, 0);
>             if (ret < 0)
> @@ -1865,7 +1868,9 @@ static int qsv_transfer_data_from(AVHWFramesContext *ctx, AVFrame *dst,
>     }
> 
>     out.Info = in->Info;
> -    map_frame_to_surface(dst_frame, &out);
> +    ret = map_frame_to_surface(dst_frame, &out);
> +    if (ret < 0)
> +	return ret;
> 
>     do {
>         err = MFXVideoVPP_RunFrameVPPAsync(s->session_download, in, &out, NULL, &sync);
> @@ -1922,7 +1927,8 @@ static int qsv_transfer_data_to(AVHWFramesContext *ctx, AVFrame *dst,
>     /* According to MSDK spec for mfxframeinfo, "Width must be a multiple of 16.
>      * Height must be a multiple of 16 for progressive frame sequence and a
>      * multiple of 32 otherwise.", so align all frames to 16 before uploading. */
> -    if (src->height & 15 || src->linesize[0] & 15) {
> +    if (src->height & 15 || src->linesize[0] & 15 ||
> +        src->linesize[0] <= 0 || src->linesize[0] > UINT16_MAX) {
>         realigned = 1;
>         if (tmp_frame->format != src->format ||
>             tmp_frame->width  != FFALIGN(src->width, 16) ||
> @@ -1963,7 +1969,9 @@ static int qsv_transfer_data_to(AVHWFramesContext *ctx, AVFrame *dst,
>     }
> 
>     in.Info = out->Info;
> -    map_frame_to_surface(src_frame, &in);
> +    ret = map_frame_to_surface(src_frame, &in);
> +    if (ret < 0)
> +	return ret;
> 
>     do {
>         err = MFXVideoVPP_RunFrameVPPAsync(s->session_upload, &in, out, NULL, &sync);
> -- 
> 2.43.0
> 
> _______________________________________________
> ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
> To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org