eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-06-16 04:32:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

avfilter/vf_stack: add checks for the final canvas dimensions

Browse Source 
Prevents potential integer overflows when trying to stitch absurdly huge images together.

Fixes #YWH-PGM40646-38.

Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 4fad136704)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit dcae33471953891813815282a6eb8baa04e13c92)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
James Almer
2026-01-03 21:31:30 -03:00
committed by Michael Niedermayer
parent 957f06d9d2
commit 2e3ce98001
1 changed files with 27 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libavfilter/vf_stack.c
+27 -6
View File
@@ -220,6 +220,8 @@ static int config_output(AVFilterLink *outlink)
item->y[1] = item->y[2] = AV_CEIL_RSHIFT(height, s->desc->log2_chroma_h);
item->y[0] = item->y[3] = height;
if (height > INT_MAX - ctx->inputs[i]->h)
return AVERROR(EINVAL);
height += ctx->inputs[i]->h;
}
}
@@ -245,6 +247,8 @@ static int config_output(AVFilterLink *outlink)
return ret;
}
if (width > INT_MAX - ctx->inputs[i]->w)
return AVERROR(EINVAL);
width += ctx->inputs[i]->w;
}
}
@@ -290,26 +294,41 @@ static int config_output(AVFilterLink *outlink)
if (size == i || size < 0 || size >= s->nb_inputs)
return AVERROR(EINVAL);
if (!j)
if (!j) {
if (inw > INT_MAX - ctx->inputs[size]->w)
return AVERROR(EINVAL);
inw += ctx->inputs[size]->w;
else
} else {
if (inh > INT_MAX - ctx->inputs[size]->w)
return AVERROR(EINVAL);
inh += ctx->inputs[size]->w;
}
} else if (sscanf(arg3, "h%d", &size) == 1) {
if (size == i || size < 0 || size >= s->nb_inputs)
return AVERROR(EINVAL);
if (!j)
if (!j) {
if (inw > INT_MAX - ctx->inputs[size]->h)
return AVERROR(EINVAL);
inw += ctx->inputs[size]->h;
else
} else {
if (inh > INT_MAX - ctx->inputs[size]->h)
return AVERROR(EINVAL);
inh += ctx->inputs[size]->h;
}
} else if (sscanf(arg3, "%d", &size) == 1) {
if (size < 0)
return AVERROR(EINVAL);
if (!j)
if (!j) {
if (inw > INT_MAX - size)
return AVERROR(EINVAL);
inw += size;
else
} else {
if (inh > INT_MAX - size)
return AVERROR(EINVAL);
inh += size;
}
} else {
return AVERROR(EINVAL);
}
@@ -323,6 +342,8 @@ static int config_output(AVFilterLink *outlink)
item->y[1] = item->y[2] = AV_CEIL_RSHIFT(inh, s->desc->log2_chroma_h);
item->y[0] = item->y[3] = inh;
if (inlink->w > INT_MAX - inw || inlink->h > INT_MAX - inh)
return AVERROR(EINVAL);
width = FFMAX(width, inlink->w + inw);
height = FFMAX(height, inlink->h + inh);
}