Fixes: CID1452758 Out-of-bounds read (actual out of bounds access depends on a frame with more than 3 planes)
Showing the changes to libavfilter (1 of 1 file). Show all
Unified · Split
| @@ -1387,8 +1387,8 @@ static int filter_frame(AVFilterLink *link, AVFrame *input_frame) · 1386 unmodified lines | ||
| 1387 | 1387 | size_t global_work[2]; |
| 1388 | 1388 | int64_t duration; |
| 1389 | 1389 | cl_mem src, transformed, dst; |
| 1390 | − cl_mem transforms[3]; | |
| 1391 | − CropInfo crops[3]; | |
| 1390 | + cl_mem transforms[AV_VIDEO_MAX_PLANES]; | |
| 1391 | + CropInfo crops[AV_VIDEO_MAX_PLANES]; | |
| 1392 | 1392 | cl_event transform_event, crop_upscale_event; |
| 1393 | 1393 | DebugMatches debug_matches; |
| 1394 | 1394 | cl_int num_model_matches; |
| @@ -1518,7 +1518,7 @@ static int filter_frame(AVFilterLink *link, AVFrame *input_frame) · 123 unmodified lines | ||
| 1518 | 1518 | transforms[0] = deshake_ctx->transform_y; |
| 1519 | 1519 | transforms[1] = transforms[2] = deshake_ctx->transform_uv; |
| 1520 | 1520 | |
| 1521 | − for (int p = 0; p < FF_ARRAY_ELEMS(transformed_frame->data); p++) { | |
| 1521 | + for (int p = 0; p < AV_VIDEO_MAX_PLANES; p++) { | |
| 1522 | 1522 | // Transform all of the planes appropriately |
| 1523 | 1523 | src = (cl_mem)input_frame->data[p]; |
| 1524 | 1524 | transformed = (cl_mem)transformed_frame->data[p]; |
| @@ -1619,7 +1619,7 @@ static int filter_frame(AVFilterLink *link, AVFrame *input_frame) · 94 unmodified lines | ||
| 1619 | 1619 | crops[0] = deshake_ctx->crop_y; |
| 1620 | 1620 | crops[1] = crops[2] = deshake_ctx->crop_uv; |
| 1621 | 1621 | |
| 1622 | − for (int p = 0; p < FF_ARRAY_ELEMS(cropped_frame->data); p++) { | |
| 1622 | + for (int p = 0; p < AV_VIDEO_MAX_PLANES; p++) { | |
| 1623 | 1623 | // Crop all of the planes appropriately |
| 1624 | 1624 | dst = (cl_mem)cropped_frame->data[p]; |
| 1625 | 1625 | transformed = (cl_mem)transformed_frame->data[p]; |