Fixes: CID1437470 Out-of-bounds read (out of bounds read would only occur with a pixel format of more than 4 planes)
Showing the changes to libavfilter (1 of 1 file). Show all
Unified · Split
| @@ -47,8 +47,8 @@ typedef struct AverageBlurOpenCLContext { · 46 unmodified lines | ||
| 47 | 47 | FilterParam luma_param; |
| 48 | 48 | FilterParam chroma_param; |
| 49 | 49 | FilterParam alpha_param; |
| 50 | − int radius[4]; | |
| 51 | − int power[4]; | |
| 50 | + int radius[AV_VIDEO_MAX_PLANES]; | |
| 51 | + int power[AV_VIDEO_MAX_PLANES]; | |
| 52 | 52 | |
| 53 | 53 | } AverageBlurOpenCLContext; |
| 54 | 54 | |
| @@ -101,7 +101,7 @@ static int avgblur_opencl_make_filter_params(AVFilterLink *inlink) · 46 unmodified lines | ||
| 101 | 101 | s->radiusV = s->radiusH; |
| 102 | 102 | } |
| 103 | 103 | |
| 104 | − for (i = 0; i < 4; i++) { | |
| 104 | + for (i = 0; i < AV_VIDEO_MAX_PLANES; i++) { | |
| 105 | 105 | s->power[i] = 1; |
| 106 | 106 | } |
| 107 | 107 | return 0; |
| @@ -133,7 +133,7 @@ static int boxblur_opencl_make_filter_params(AVFilterLink *inlink) · 25 unmodified lines | ||
| 133 | 133 | s->power[U] = s->power[V] = s->chroma_param.power; |
| 134 | 134 | s->power[A] = s->alpha_param.power; |
| 135 | 135 | |
| 136 | − for (i = 0; i < 4; i++) { | |
| 136 | + for (i = 0; i < AV_VIDEO_MAX_PLANES; i++) { | |
| 137 | 137 | if (s->power[i] == 0) { |
| 138 | 138 | s->power[i] = 1; |
| 139 | 139 | s->radius[i] = 0; |
| @@ -191,7 +191,7 @@ static int avgblur_opencl_filter_frame(AVFilterLink *inlink, AVFrame *input) · 51 unmodified lines | ||
| 191 | 191 | goto fail; |
| 192 | 192 | } |
| 193 | 193 | |
| 194 | − for (p = 0; p < FF_ARRAY_ELEMS(output->data); p++) { | |
| 194 | + for (p = 0; p < FFMIN(FF_ARRAY_ELEMS(output->data), AV_VIDEO_MAX_PLANES); p++) { | |
| 195 | 195 | src = (cl_mem) input->data[p]; |
| 196 | 196 | dst = (cl_mem) output->data[p]; |
| 197 | 197 | inter = (cl_mem)intermediate->data[p]; |