dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-09 01:21:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

avfilter/vf_floodfill: size the point stack for the current frame

Browse Source 
Fixes: out of array access
Fixes: 8aj_floodfill_dynamic_size.pgm / 8aj_generate_floodfill_dynamic_size_pgm.py
Fixes: 3MleMXjGZvu3
Found-by: Adrian Junge (vurlo) <adjun37@gmail.com>
(cherry picked from commit 24c322fdb2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-07-11 16:47:28 +02:00
parent 989444060d
commit a20608d325
1 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
libavfilter/vf_floodfill.c
View File

@@ -41,6 +41,7 @@ typedef struct FloodfillContext {
int nb_planes;
int back, front;
Points *points;
unsigned int points_size;
int (*is_same)(const AVFrame *frame, int x, int y,
unsigned s0, unsigned s1, unsigned s2, unsigned s3);
@@ -271,9 +272,6 @@ static int config_input(AVFilterLink *inlink)
}
s->front = s->back = 0;
s->points = av_calloc(inlink->w * inlink->h, 4 * sizeof(Points));
if (!s->points)
return AVERROR(ENOMEM);
return 0;
}
@@ -292,8 +290,23 @@ static int filter_frame(AVFilterLink *link, AVFrame *frame)
int s3 = s->s[3];
const int w = frame->width;
const int h = frame->height;
size_t nb_points, points_size;
int i, ret;
if (w > UINT16_MAX + 1 || h > UINT16_MAX + 1 ||
av_size_mult(w, h, &nb_points) < 0 ||
av_size_mult(nb_points, 4 * sizeof(*s->points), &points_size) < 0) {
av_frame_free(&frame);
return AVERROR(EINVAL);
}
av_fast_malloc(&s->points, &s->points_size, points_size);
if (!s->points) {
av_frame_free(&frame);
return AVERROR(ENOMEM);
}
s->front = s->back = 0;
if (is_inside(s->x, s->y, w, h)) {
s->pick_pixel(frame, s->x, s->y, &s0, &s1, &s2, &s3);