eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-12-21 14:30:10 +01:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/exr: Dont access outside xsize/ysize

Browse Source 
Fixes: out of array access
Fixes: BIGSLEEP-436510316/dwa_uncompress_write.exr

Found-by: Google Big Sleep
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2025-08-06 10:35:15 +02:00
committed by michaelni
parent 0d9c003d76
commit f45da79b2c
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/exr.c
View File

@@ -1127,6 +1127,8 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse
float *yb = td->block[0]; float *yb = td->block[0];
float *ub = td->block[1]; float *ub = td->block[1];
float *vb = td->block[2]; float *vb = td->block[2];
int bw = FFMIN(8, td->xsize - x);
int bh = FFMIN(8, td->ysize - y);
memset(td->block, 0, sizeof(td->block)); memset(td->block, 0, sizeof(td->block));
@@ -1151,8 +1153,8 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse
uint16_t *ro = ((uint16_t *)td->uncompressed_data) + uint16_t *ro = ((uint16_t *)td->uncompressed_data) +
y * td->xsize * s->nb_channels + td->xsize * (o + 2) + x; y * td->xsize * s->nb_channels + td->xsize * (o + 2) + x;
for (int yy = 0; yy < 8; yy++) { for (int yy = 0; yy < bh; yy++) {
for (int xx = 0; xx < 8; xx++) { for (int xx = 0; xx < bw; xx++) {
const int idx = xx + yy * 8; const int idx = xx + yy * 8;
float b, g, r; float b, g, r;
@@ -1175,8 +1177,8 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse
float *ro = ((float *)td->uncompressed_data) + float *ro = ((float *)td->uncompressed_data) +
y * td->xsize * s->nb_channels + td->xsize * (o + 2) + x; y * td->xsize * s->nb_channels + td->xsize * (o + 2) + x;
for (int yy = 0; yy < 8; yy++) { for (int yy = 0; yy < bh; yy++) {
for (int xx = 0; xx < 8; xx++) { for (int xx = 0; xx < bw; xx++) {
const int idx = xx + yy * 8; const int idx = xx + yy * 8;
convert(yb[idx], ub[idx], vb[idx], &bo[xx], &go[xx], &ro[xx]); convert(yb[idx], ub[idx], vb[idx], &bo[xx], &go[xx], &ro[xx]);