diff options
| author | Kevin Mark <kmark937@gmail.com> | 2017-06-03 12:04:19 +0300 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2017-06-04 00:14:04 +0300 |
| commit | 08213e0b7974b7e75d9031d6e448be49a494c0a1 (patch) | |
| tree | bd68adf2f5402bd4f3f998efedb78a813aaee26e /libavfilter/scale.c | |
| parent | be3809a521fecfd3a61db99d660f243bd32b30bb (diff) | |
libavfilter/scale2ref: Fix out-of-bounds array access
ff_scale_eval_dimensions blindly assumes that two inputs are always
available as of 3385989b98be7940044e4f0a6b431a0a00abf2fa. This is
notably not the case when the function is called for the scale
filter. With the scale filter inputs[1] does not exist.
ff_scale_eval_dimensions now has an updated scale2ref check that
makes certain two inputs are actually available before attempting to
access the second one.
Thanks to James Almer for reporting this bug. This should fix the 820
Valgrind tests I single-handedly managed to break.
Signed-off-by: Kevin Mark <kmark937@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavfilter/scale.c')
| -rw-r--r-- | libavfilter/scale.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavfilter/scale.c b/libavfilter/scale.c index e3a2fb5923..03745ddcb8 100644 --- a/libavfilter/scale.c +++ b/libavfilter/scale.c @@ -115,7 +115,7 @@ int ff_scale_eval_dimensions(void *log_ctx, int factor_w, factor_h; int eval_w, eval_h; int ret; - const char scale2ref = outlink->src->inputs[1] == inlink; + const char scale2ref = outlink->src->nb_inputs == 2 && outlink->src->inputs[1] == inlink; double var_values[VARS_NB + VARS_S2R_NB], res; const AVPixFmtDescriptor *main_desc; const AVFilterLink *main_link; |