History

avfilter/vf_scale: fix off-by-one in loop bounds

Results in over-read of the array. Fortunately, the excess element was never actually used, but it still triggers ASAN (and could in theory trigger a segfault).

Niklas Haas committed 1 year ago

Commit bcbf3a51 parent 3c3bf6c1 file · +2 −2Browse files

Unified · Split

libavfilter/vf_scale.c+2−2
@@ -482,7 +482,7 @@ static int query_formats(const AVFilterContext *ctx, · 481 unmodified lines
482482 formats = ff_all_color_spaces();
483483 for (int i = 0; i < formats->nb_formats; i++) {
484484 if (!sws_test_colorspace(formats->formats[i], 0)) {
485− for (int j = i--; j < formats->nb_formats; j++)
485+ for (int j = i--; j + 1 < formats->nb_formats; j++)
486486 formats->formats[j] = formats->formats[j + 1];
487487 formats->nb_formats--;
488488 }
@@ -501,7 +501,7 @@ static int query_formats(const AVFilterContext *ctx, · 12 unmodified lines
501501 formats = ff_all_color_spaces();
502502 for (int i = 0; i < formats->nb_formats; i++) {
503503 if (!sws_test_colorspace(formats->formats[i], 1)) {
504− for (int j = i--; j < formats->nb_formats; j++)
504+ for (int j = i--; j + 1 < formats->nb_formats; j++)
505505 formats->formats[j] = formats->formats[j + 1];
506506 formats->nb_formats--;
507507 }

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t