From fa543b33f63478090137d124c20ff97f76251254 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 6 Aug 2025 10:35:15 +0200 Subject: [PATCH] avcodec/exr: Dont access outside xsize/ysize Fixes: out of array access Fixes: BIGSLEEP-436510316/dwa_uncompress_write.exr Found-by: Google Big Sleep Signed-off-by: Michael Niedermayer (cherry picked from commit f45da79b2c336c5f8f3e563d72b8a22fecdcde0c) Signed-off-by: Michael Niedermayer --- libavcodec/exr.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/libavcodec/exr.c b/libavcodec/exr.c index cffd250a3c..96aafb77a2 100644 --- a/libavcodec/exr.c +++ b/libavcodec/exr.c @@ -1106,6 +1106,9 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse for (int y = 0; y < td->ysize; y += 8) { for (int x = 0; x < td->xsize; x += 8) { + int bw = FFMIN(8, td->xsize - x); + int bh = FFMIN(8, td->ysize - y); + memset(td->block, 0, sizeof(td->block)); for (int j = 0; j < 3; j++) { @@ -1133,8 +1136,8 @@ static int dwa_uncompress(const EXRContext *s, const uint8_t *src, int compresse float *ub = td->block[1]; float *vb = td->block[2]; - for (int yy = 0; yy < 8; yy++) { - for (int xx = 0; xx < 8; xx++) { + for (int yy = 0; yy < bh; yy++) { + for (int xx = 0; xx < bw; xx++) { const int idx = xx + yy * 8; convert(yb[idx], ub[idx], vb[idx], &bo[xx], &go[xx], &ro[xx]);