Files
ffmpeg/libavfilter
Zhao Zhili 0533af2893 avfilter/vf_ssim360: fix integer overflow in tape_length allocation
tape_length * 8 overflows 32-bit int for large input widths. Then
av_malloc_array() allocates a tiny buffer while the subsequent
loop writes tape_length*8 BilinearMap entries, causing
heap-buffer-overflow.

Validate the value in float before converting to int and left
shifting, to avoid both float-to-int and signed left shift
overflow UB. Also split av_malloc_array() arguments to avoid
the multiplication overflow.

Fixes: #21511

Signed-off-by: Zhao Zhili <zhilizhao@tencent.com>
(cherry picked from commit b62ae766c1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2026-05-04 17:13:33 +02:00
..
2025-12-03 20:27:24 +01:00
2023-09-28 00:17:47 +02:00
2024-07-24 16:52:32 +02:00
2024-07-24 16:52:32 +02:00
2023-09-27 10:22:33 -07:00
2025-12-03 20:27:24 +01:00
2025-12-03 20:27:24 +01:00
2023-10-29 16:19:39 +01:00
2023-03-29 00:15:19 +02:00
2024-07-24 16:52:51 +02:00
2025-12-03 20:27:24 +01:00