xaymar/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

swscale/utils: Check *Inc

Browse Source 
Fixes: signed integer overflow: -2147483648 - 65536 cannot be represented in type 'int'
Fixes: #21588

Found-by: HAORAN FANG
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 946ce12e1c)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-03-03 20:41:30 +01:00
parent 007877d3d0
commit 9dd5bd8fde
1 changed files with 19 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libswscale/utils.c
+19 -8
View File
@@ -1295,8 +1295,8 @@ av_cold int sws_init_context(SwsContext *c, SwsFilter *srcFilter,
if (!srcFilter)
srcFilter = &dummyFilter;
c->lumXInc = (((int64_t)srcW << 16) + (dstW >> 1)) / dstW;
c->lumYInc = (((int64_t)srcH << 16) + (dstH >> 1)) / dstH;
int64_t lumXInc = (((int64_t)srcW << 16) + (dstW >> 1)) / dstW;
int64_t lumYInc = (((int64_t)srcH << 16) + (dstH >> 1)) / dstH;
c->dstFormatBpp = av_get_bits_per_pixel(desc_dst);
c->srcFormatBpp = av_get_bits_per_pixel(desc_src);
c->vRounder = 4 * 0x0001000100010001ULL;
@@ -1464,8 +1464,8 @@ av_cold int sws_init_context(SwsContext *c, SwsFilter *srcFilter,
} else
c->canMMXEXTBeUsed = 0;
c->chrXInc = (((int64_t)c->chrSrcW << 16) + (c->chrDstW >> 1)) / c->chrDstW;
c->chrYInc = (((int64_t)c->chrSrcH << 16) + (c->chrDstH >> 1)) / c->chrDstH;
int64_t chrXInc = (((int64_t)c->chrSrcW << 16) + (c->chrDstW >> 1)) / c->chrDstW;
int64_t chrYInc = (((int64_t)c->chrSrcH << 16) + (c->chrDstH >> 1)) / c->chrDstH;
/* Match pixel 0 of the src to pixel 0 of dst and match pixel n-2 of src
* to pixel n-2 of dst, but only for the FAST_BILINEAR mode otherwise do
@@ -1476,15 +1476,26 @@ av_cold int sws_init_context(SwsContext *c, SwsFilter *srcFilter,
* some special code for the first and last pixel */
if (flags & SWS_FAST_BILINEAR) {
if (c->canMMXEXTBeUsed) {
c->lumXInc += 20;
c->chrXInc += 20;
lumXInc += 20;
chrXInc += 20;
}
// we don't use the x86 asm scaler if MMX is available
else if (INLINE_MMX(cpu_flags) && c->dstBpc <= 14) {
c->lumXInc = ((int64_t)(srcW - 2) << 16) / (dstW - 2) - 20;
c->chrXInc = ((int64_t)(c->chrSrcW - 2) << 16) / (c->chrDstW - 2) - 20;
lumXInc = ((int64_t)(srcW - 2) << 16) / (dstW - 2) - 20;
chrXInc = ((int64_t)(c->chrSrcW - 2) << 16) / (c->chrDstW - 2) - 20;
}
}
if (chrXInc < 10 || chrXInc > INT_MAX ||
chrYInc < 10 || chrYInc > INT_MAX ||
lumXInc < 10 || lumXInc > INT_MAX ||
lumYInc < 10 || lumYInc > INT_MAX)
return AVERROR_PATCHWELCOME;
c->lumXInc = lumXInc;
c->lumYInc = lumYInc;
c->chrXInc = chrXInc;
c->chrYInc = chrYInc;
// hardcoded for now
c->gamma_value = 2.2;