eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-12-12 18:10:13 +01:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/exr: Dont access outside xsize/ysize

Browse Source 
Fixes: out of array access
Fixes: BIGSLEEP-436510316/dwa_uncompress_write.exr

Found-by: Google Big Sleep
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit f45da79b2c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2025-08-06 10:35:15 +02:00
parent 63c4658e62
commit fa543b33f6
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/exr.c
View File

@@ -1106,6 +1106,9 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse
for (int y = 0; y < td->ysize; y += 8) {
for (int x = 0; x < td->xsize; x += 8) {
int bw = FFMIN(8, td->xsize - x);
int bh = FFMIN(8, td->ysize - y);
memset(td->block, 0, sizeof(td->block));
for (int j = 0; j < 3; j++) {
@@ -1133,8 +1136,8 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse
float *ub = td->block[1];
float *vb = td->block[2];
for (int yy = 0; yy < 8; yy++) {
for (int xx = 0; xx < 8; xx++) {
for (int yy = 0; yy < bh; yy++) {
for (int xx = 0; xx < bw; xx++) {
const int idx = xx + yy * 8;
convert(yb[idx], ub[idx], vb[idx], &bo[xx], &go[xx], &ro[xx]);