xenia-project/FFmpeg
1
0
Fork 0
mirror of https://github.com/xenia-project/FFmpeg.git synced 2025-02-04 11:09:09 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

avfilter: fix plane validity checks

Browse Source 
Fixes out of array accesses

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-08-03 18:54:43 +02:00
parent bc4e798562
commit e43a0a232d
11 changed files with 14 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavfilter/vf_boxblur.c
View File

@ -313,13 +313,13 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
} }
av_frame_copy_props(out, in); av_frame_copy_props(out, in);
for (plane = 0; in->data[plane] && plane < 4; plane++) for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++)
hblur(out->data[plane], out->linesize[plane], hblur(out->data[plane], out->linesize[plane],
in ->data[plane], in ->linesize[plane], in ->data[plane], in ->linesize[plane],
w[plane], h[plane], s->radius[plane], s->power[plane], w[plane], h[plane], s->radius[plane], s->power[plane],
s->temp); s->temp);
for (plane = 0; in->data[plane] && plane < 4; plane++) for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++)
vblur(out->data[plane], out->linesize[plane], vblur(out->data[plane], out->linesize[plane],
out->data[plane], out->linesize[plane], out->data[plane], out->linesize[plane],
w[plane], h[plane], s->radius[plane], s->power[plane], w[plane], h[plane], s->radius[plane], s->power[plane],

2
libavfilter/vf_delogo.c
View File

@ -237,7 +237,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
if (!sar.num) if (!sar.num)
sar.num = sar.den = 1; sar.num = sar.den = 1;
for (plane = 0; plane < 4 && in->data[plane]; plane++) { for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++) {
int hsub = plane == 1 || plane == 2 ? hsub0 : 0; int hsub = plane == 1 || plane == 2 ? hsub0 : 0;
int vsub = plane == 1 || plane == 2 ? vsub0 : 0; int vsub = plane == 1 || plane == 2 ? vsub0 : 0;

2
libavfilter/vf_fieldmatch.c
View File

@ -608,7 +608,7 @@ static void copy_fields(const FieldMatchContext *fm, AVFrame *dst,
const AVFrame *src, int field) const AVFrame *src, int field)
{ {
int plane; int plane;
for (plane = 0; plane < 4 && src->data[plane]; plane++) for (plane = 0; plane < 4 && src->data[plane] && src->linesize[plane]; plane++)
av_image_copy_plane(dst->data[plane] + field*dst->linesize[plane], dst->linesize[plane] << 1, av_image_copy_plane(dst->data[plane] + field*dst->linesize[plane], dst->linesize[plane] << 1,
src->data[plane] + field*src->linesize[plane], src->linesize[plane] << 1, src->data[plane] + field*src->linesize[plane], src->linesize[plane] << 1,
get_width(fm, src, plane), get_height(fm, src, plane) / 2); get_width(fm, src, plane), get_height(fm, src, plane) / 2);

2
libavfilter/vf_fieldorder.c
View File

@ -106,7 +106,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *frame)
"picture will move %s one line\n", "picture will move %s one line\n",
s->dst_tff ? "up" : "down"); s->dst_tff ? "up" : "down");
h = frame->height; h = frame->height;
for (plane = 0; plane < 4 && frame->data[plane]; plane++) { for (plane = 0; plane < 4 && frame->data[plane] && frame->linesize[plane]; plane++) {
line_step = frame->linesize[plane]; line_step = frame->linesize[plane];
line_size = s->line_size[plane]; line_size = s->line_size[plane];
data = frame->data[plane]; data = frame->data[plane];

2
libavfilter/vf_gradfun.c
View File

@ -199,7 +199,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
av_frame_copy_props(out, in); av_frame_copy_props(out, in);
} }
for (p = 0; p < 4 && in->data[p]; p++) { for (p = 0; p < 4 && in->data[p] && in->linesize[p]; p++) {
int w = inlink->w; int w = inlink->w;
int h = inlink->h; int h = inlink->h;
int r = s->radius; int r = s->radius;

2
libavfilter/vf_hflip.c
View File

@ -90,7 +90,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
if (av_pix_fmt_desc_get(inlink->format)->flags & AV_PIX_FMT_FLAG_PAL) if (av_pix_fmt_desc_get(inlink->format)->flags & AV_PIX_FMT_FLAG_PAL)
memcpy(out->data[1], in->data[1], AVPALETTE_SIZE); memcpy(out->data[1], in->data[1], AVPALETTE_SIZE);
for (plane = 0; plane < 4 && in->data[plane]; plane++) { for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++) {
const int width = (plane == 1 || plane == 2) ? FF_CEIL_RSHIFT(inlink->w, s->hsub) : inlink->w; const int width = (plane == 1 || plane == 2) ? FF_CEIL_RSHIFT(inlink->w, s->hsub) : inlink->w;
const int height = (plane == 1 || plane == 2) ? FF_CEIL_RSHIFT(inlink->h, s->vsub) : inlink->h; const int height = (plane == 1 || plane == 2) ? FF_CEIL_RSHIFT(inlink->h, s->vsub) : inlink->h;
step = s->max_step[plane]; step = s->max_step[plane];

2
libavfilter/vf_kerndeint.c
View File

@ -150,7 +150,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *inpic)
av_frame_copy_props(outpic, inpic); av_frame_copy_props(outpic, inpic);
outpic->interlaced_frame = 0; outpic->interlaced_frame = 0;
for (plane = 0; inpic->data[plane] && plane < 4; plane++) { for (plane = 0; plane < 4 && inpic->data[plane] && inpic->linesize[plane]; plane++) {
h = plane == 0 ? inlink->h : FF_CEIL_RSHIFT(inlink->h, kerndeint->vsub); h = plane == 0 ? inlink->h : FF_CEIL_RSHIFT(inlink->h, kerndeint->vsub);
bwidth = kerndeint->tmp_bwidth[plane]; bwidth = kerndeint->tmp_bwidth[plane];

2
libavfilter/vf_lut.c
View File

@ -304,7 +304,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
} }
} else { } else {
/* planar */ /* planar */
for (plane = 0; plane < 4 && in->data[plane]; plane++) { for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++) {
int vsub = plane == 1 || plane == 2 ? s->vsub : 0; int vsub = plane == 1 || plane == 2 ? s->vsub : 0;
int hsub = plane == 1 || plane == 2 ? s->hsub : 0; int hsub = plane == 1 || plane == 2 ? s->hsub : 0;
int h = FF_CEIL_RSHIFT(inlink->h, vsub); int h = FF_CEIL_RSHIFT(inlink->h, vsub);

4
libavfilter/vf_pad.c
View File

@ -214,7 +214,7 @@ static AVFrame *get_video_buffer(AVFilterLink *inlink, int w, int h)
frame->width = w; frame->width = w;
frame->height = h; frame->height = h;
for (plane = 0; plane < 4 && frame->data[plane]; plane++) { for (plane = 0; plane < 4 && frame->data[plane] && frame->linesize[plane]; plane++) {
int hsub = s->draw.hsub[plane]; int hsub = s->draw.hsub[plane];
int vsub = s->draw.vsub[plane]; int vsub = s->draw.vsub[plane];
frame->data[plane] += (s->x >> hsub) * s->draw.pixelstep[plane] + frame->data[plane] += (s->x >> hsub) * s->draw.pixelstep[plane] +
@ -311,7 +311,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
int i; int i;
out = in; out = in;
for (i = 0; i < 4 && out->data[i]; i++) { for (i = 0; i < 4 && out->data[i] && out->linesize[i]; i++) {
int hsub = s->draw.hsub[i]; int hsub = s->draw.hsub[i];
int vsub = s->draw.vsub[i]; int vsub = s->draw.vsub[i];
out->data[i] -= (s->x >> hsub) * s->draw.pixelstep[i] + out->data[i] -= (s->x >> hsub) * s->draw.pixelstep[i] +

4
libavfilter/vf_showinfo.c
View File

@ -38,7 +38,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *frame)
uint32_t plane_checksum[4] = {0}, checksum = 0; uint32_t plane_checksum[4] = {0}, checksum = 0;
int i, plane, vsub = desc->log2_chroma_h; int i, plane, vsub = desc->log2_chroma_h;
for (plane = 0; plane < 4 && frame->data[plane]; plane++) { for (plane = 0; plane < 4 && frame->data[plane] && frame->linesize[plane]; plane++) {
int64_t linesize = av_image_get_linesize(frame->format, frame->width, plane); int64_t linesize = av_image_get_linesize(frame->format, frame->width, plane);
uint8_t *data = frame->data[plane]; uint8_t *data = frame->data[plane];
int h = plane == 1 || plane == 2 ? FF_CEIL_RSHIFT(inlink->h, vsub) : inlink->h; int h = plane == 1 || plane == 2 ? FF_CEIL_RSHIFT(inlink->h, vsub) : inlink->h;
@ -68,7 +68,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *frame)
av_get_picture_type_char(frame->pict_type), av_get_picture_type_char(frame->pict_type),
checksum, plane_checksum[0]); checksum, plane_checksum[0]);
for (plane = 1; plane < 4 && frame->data[plane]; plane++) for (plane = 1; plane < 4 && frame->data[plane] && frame->linesize[plane]; plane++)
av_log(ctx, AV_LOG_INFO, " %08X", plane_checksum[plane]); av_log(ctx, AV_LOG_INFO, " %08X", plane_checksum[plane]);
av_log(ctx, AV_LOG_INFO, "]\n"); av_log(ctx, AV_LOG_INFO, "]\n");

2
libavfilter/vf_vignette.c
View File

@ -239,7 +239,7 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
} else { } else {
int plane; int plane;
for (plane = 0; plane < 4 && in->data[plane]; plane++) { for (plane = 0; plane < 4 && in->data[plane] && in->linesize[plane]; plane++) {
uint8_t *dst = out->data[plane]; uint8_t *dst = out->data[plane];
const uint8_t *src = in ->data[plane]; const uint8_t *src = in ->data[plane];
const float *fmap = s->fmap; const float *fmap = s->fmap;