Fixes: CID1452758 Out-of-bounds read (actual out of bounds access depends on a frame with more than 3 planes)
Unified · Split
| @@ -1387,8 +1387,8 @@ static int filter_frame(AVFilterLink *link, AVFrame *input_frame) · 1386 unmodified lines | |||
| 1387 | size_t global_work[2]; | 1387 | size_t global_work[2]; |
| 1388 | int64_t duration; | 1388 | int64_t duration; |
| 1389 | cl_mem src, transformed, dst; | 1389 | cl_mem src, transformed, dst; |
| 1390 | cl_mem transforms[3]; | 1390 | cl_mem transforms[AV_VIDEO_MAX_PLANES]; |
| 1391 | CropInfo crops[3]; | 1391 | CropInfo crops[AV_VIDEO_MAX_PLANES]; |
| 1392 | cl_event transform_event, crop_upscale_event; | 1392 | cl_event transform_event, crop_upscale_event; |
| 1393 | DebugMatches debug_matches; | 1393 | DebugMatches debug_matches; |
| 1394 | cl_int num_model_matches; | 1394 | cl_int num_model_matches; |
| @@ -1518,7 +1518,7 @@ static int filter_frame(AVFilterLink *link, AVFrame *input_frame) · 123 unmodified lines | |||
| 1518 | transforms[0] = deshake_ctx->transform_y; | 1518 | transforms[0] = deshake_ctx->transform_y; |
| 1519 | transforms[1] = transforms[2] = deshake_ctx->transform_uv; | 1519 | transforms[1] = transforms[2] = deshake_ctx->transform_uv; |
| 1520 | 1520 | ||
| 1521 | for (int p = 0; p < FF_ARRAY_ELEMS(transformed_frame->data); p++) { | 1521 | for (int p = 0; p < AV_VIDEO_MAX_PLANES; p++) { |
| 1522 | // Transform all of the planes appropriately | 1522 | // Transform all of the planes appropriately |
| 1523 | src = (cl_mem)input_frame->data[p]; | 1523 | src = (cl_mem)input_frame->data[p]; |
| 1524 | transformed = (cl_mem)transformed_frame->data[p]; | 1524 | transformed = (cl_mem)transformed_frame->data[p]; |
| @@ -1619,7 +1619,7 @@ static int filter_frame(AVFilterLink *link, AVFrame *input_frame) · 94 unmodified lines | |||
| 1619 | crops[0] = deshake_ctx->crop_y; | 1619 | crops[0] = deshake_ctx->crop_y; |
| 1620 | crops[1] = crops[2] = deshake_ctx->crop_uv; | 1620 | crops[1] = crops[2] = deshake_ctx->crop_uv; |
| 1621 | 1621 | ||
| 1622 | for (int p = 0; p < FF_ARRAY_ELEMS(cropped_frame->data); p++) { | 1622 | for (int p = 0; p < AV_VIDEO_MAX_PLANES; p++) { |
| 1623 | // Crop all of the planes appropriately | 1623 | // Crop all of the planes appropriately |
| 1624 | dst = (cl_mem)cropped_frame->data[p]; | 1624 | dst = (cl_mem)cropped_frame->data[p]; |
| 1625 | transformed = (cl_mem)transformed_frame->data[p]; | 1625 | transformed = (cl_mem)transformed_frame->data[p]; |