avfilter/vf_lut3d: compute size2 after the 3DLUTSIZE directive

Fixes: out of array access
Fixes: lut3d_poc/poc_3dlut2.dat
Fixes: 6p0ahHBxreqG
Found-by: SecBuddyF - Tencent KeenLab
This commit is contained in:
Michael Niedermayer
2026-07-10 04:07:17 +02:00
committed by michaelni
parent fc4b523596
commit 0089694c06

View File

@@ -644,7 +644,6 @@ static int parse_dat(AVFilterContext *ctx, FILE *f)
int ret, i, j, k, size, size2;
lut3d->lutsize = size = 33;
size2 = size * size;
NEXT_LINE(skip_line(line));
if (!strncmp(line, "3DLUTSIZE ", 10)) {
@@ -652,6 +651,7 @@ static int parse_dat(AVFilterContext *ctx, FILE *f)
NEXT_LINE(skip_line(line));
}
size2 = size * size;
ret = allocate_3dlut(ctx, size, 0);
if (ret < 0)