| Patrick Williams | 213cb26 | 2021-08-07 19:21:33 -0500 | [diff] [blame] | 1 | From 82ad1b76751bcfad5005440db48c46a4de5d6f02 Mon Sep 17 00:00:00 2001 |
| 2 | From: Michael Niedermayer <michael@niedermayer.cc> |
| 3 | Date: Sat, 29 May 2021 09:58:31 +0200 |
| 4 | Subject: [PATCH] avfilter/vf_vmafmotion: Check dimensions |
| 5 | |
| 6 | Fixes: out of array access |
| 7 | Fixes: Ticket8241 |
| 8 | Fixes: Ticket8246 |
| 9 | Fixes: CVE-2020-22019 |
| 10 | Fixes: CVE-2020-22033 |
| 11 | |
| 12 | Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> |
| 13 | |
| 14 | |
| 15 | CVE: CVE-2020-22033 |
| 16 | CVE: CVE-2020-22019 |
| 17 | Upstream-Status: Backport [82ad1b76751bcfad5005440db48c46a4de5d6f02] |
| 18 | |
| 19 | Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com> |
| 20 | --- |
| 21 | libavfilter/vf_vmafmotion.c | 3 +++ |
| 22 | 1 file changed, 3 insertions(+) |
| 23 | |
| 24 | diff --git a/libavfilter/vf_vmafmotion.c b/libavfilter/vf_vmafmotion.c |
| 25 | index 2db4783d8d..454ebb8afa 100644 |
| 26 | --- a/libavfilter/vf_vmafmotion.c |
| 27 | +++ b/libavfilter/vf_vmafmotion.c |
| 28 | @@ -238,6 +238,9 @@ int ff_vmafmotion_init(VMAFMotionData *s, |
| 29 | int i; |
| 30 | const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(fmt); |
| 31 | |
| 32 | + if (w < 3 || h < 3) |
| 33 | + return AVERROR(EINVAL); |
| 34 | + |
| 35 | s->width = w; |
| 36 | s->height = h; |
| 37 | s->stride = FFALIGN(w * sizeof(uint16_t), 32); |
| 38 | -- |
| 39 | 2.32.0 |
| 40 | |