Fixes: CID1437470 Out-of-bounds read (out of bounds read would only occur with a pixel format of more than 4 planes)
Showing the changes to libavfilter (1 of 1 file). Show all
Unified · Split
| @@ -47,8 +47,8 @@ typedef struct AverageBlurOpenCLContext { · 46 unmodified lines | |||
| 47 | FilterParam luma_param; | 47 | FilterParam luma_param; |
| 48 | FilterParam chroma_param; | 48 | FilterParam chroma_param; |
| 49 | FilterParam alpha_param; | 49 | FilterParam alpha_param; |
| 50 | int radius[4]; | 50 | int radius[AV_VIDEO_MAX_PLANES]; |
| 51 | int power[4]; | 51 | int power[AV_VIDEO_MAX_PLANES]; |
| 52 | 52 | ||
| 53 | } AverageBlurOpenCLContext; | 53 | } AverageBlurOpenCLContext; |
| 54 | 54 | ||
| @@ -101,7 +101,7 @@ static int avgblur_opencl_make_filter_params(AVFilterLink *inlink) · 46 unmodified lines | |||
| 101 | s->radiusV = s->radiusH; | 101 | s->radiusV = s->radiusH; |
| 102 | } | 102 | } |
| 103 | 103 | ||
| 104 | for (i = 0; i < 4; i++) { | 104 | for (i = 0; i < AV_VIDEO_MAX_PLANES; i++) { |
| 105 | s->power[i] = 1; | 105 | s->power[i] = 1; |
| 106 | } | 106 | } |
| 107 | return 0; | 107 | return 0; |
| @@ -133,7 +133,7 @@ static int boxblur_opencl_make_filter_params(AVFilterLink *inlink) · 25 unmodified lines | |||
| 133 | s->power[U] = s->power[V] = s->chroma_param.power; | 133 | s->power[U] = s->power[V] = s->chroma_param.power; |
| 134 | s->power[A] = s->alpha_param.power; | 134 | s->power[A] = s->alpha_param.power; |
| 135 | 135 | ||
| 136 | for (i = 0; i < 4; i++) { | 136 | for (i = 0; i < AV_VIDEO_MAX_PLANES; i++) { |
| 137 | if (s->power[i] == 0) { | 137 | if (s->power[i] == 0) { |
| 138 | s->power[i] = 1; | 138 | s->power[i] = 1; |
| 139 | s->radius[i] = 0; | 139 | s->radius[i] = 0; |
| @@ -191,7 +191,7 @@ static int avgblur_opencl_filter_frame(AVFilterLink *inlink, AVFrame *input) · 51 unmodified lines | |||
| 191 | goto fail; | 191 | goto fail; |
| 192 | } | 192 | } |
| 193 | 193 | ||
| 194 | for (p = 0; p < FF_ARRAY_ELEMS(output->data); p++) { | 194 | for (p = 0; p < FFMIN(FF_ARRAY_ELEMS(output->data), AV_VIDEO_MAX_PLANES); p++) { |
| 195 | src = (cl_mem) input->data[p]; | 195 | src = (cl_mem) input->data[p]; |
| 196 | dst = (cl_mem) output->data[p]; | 196 | dst = (cl_mem) output->data[p]; |
| 197 | inter = (cl_mem)intermediate->data[p]; | 197 | inter = (cl_mem)intermediate->data[p]; |