dilim/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2026-08-09 17:39:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

avfilter/vf_v360: keep remap source coordinates in bounds

Browse Source 
Two runtime paths could compute out-of-range source coordinates for
degenerate projection geometry, causing heap-buffer-overflow reads

Fixes: out of array read
Fixes: assertion failure
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-06-27 21:31:23 +02:00
committed by michaelni
parent b3712addc9
commit a73d648f6e
1 changed files with 21 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
libavfilter/vf_v360.c
View File

@@ -806,7 +806,7 @@ static inline int ereflectx(int x, int y, int w, int h)
static inline int reflectx(int x, int y, int w, int h)
{
if (y < 0 || y >= h)
return w - 1 - x;
return av_clip(w - 1 - x, 0, w - 1);
return mod(x, w);
}
@@ -1867,9 +1867,14 @@ static int stereographic_to_xyz(const V360Context *s,
const float theta = atanf(r) * 2.f;
const float sin_theta = sinf(theta);
vec[0] = x / r * sin_theta;
vec[1] = y / r * sin_theta;
vec[2] = cosf(theta);
if (r > 0.f) {
vec[0] = x / r * sin_theta;
vec[1] = y / r * sin_theta;
vec[2] = cosf(theta);
} else {
vec[0] = vec[1] = 0.f;
vec[2] = 1.f;
}
return 1;
}
@@ -1971,9 +1976,14 @@ static int equisolid_to_xyz(const V360Context *s,
const float theta = asinf(r) * 2.f;
const float sin_theta = sinf(theta);
vec[0] = x / r * sin_theta;
vec[1] = y / r * sin_theta;
vec[2] = cosf(theta);
if (r > 0.f) {
vec[0] = x / r * sin_theta;
vec[1] = y / r * sin_theta;
vec[2] = cosf(theta);
} else {
vec[0] = vec[1] = 0.f;
vec[2] = 1.f;
}
return 1;
}
@@ -4266,6 +4276,10 @@ static int v360_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs)
out_mask = s->out_transform(s, j, i, height, width, vec);
else
out_mask = s->out_transform(s, i, j, width, height, vec);
if (!isfinite(vec[0]) || !isfinite(vec[1]) || !isfinite(vec[2])) {
vec[0] = vec[1] = 0.f;
vec[2] = 1.f;
}
offset_vector(vec, s->h_offset, s->v_offset);
normalize_vector(vec);
av_assert1(!isnan(vec[0]) && !isnan(vec[1]) && !isnan(vec[2]));