From a342517710690a8f113986e8d8e9d9ffabb701fe Mon Sep 17 00:00:00 2001 From: Stefano Sabatini Date: Wed, 3 Aug 2011 00:01:41 +0200 Subject: vf_boxblur: fix out-of-buffer access when h > w Increase size of the private temporary buffers from w to FFMAX(w, h), indeed they are used also for blurring vertical lines with length h. --- libavfilter/vf_boxblur.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'libavfilter') diff --git a/libavfilter/vf_boxblur.c b/libavfilter/vf_boxblur.c index 398014a0b9..676d2057cb 100644 --- a/libavfilter/vf_boxblur.c +++ b/libavfilter/vf_boxblur.c @@ -144,8 +144,8 @@ static int config_input(AVFilterLink *inlink) char *expr; int ret; - if (!(boxblur->temp[0] = av_malloc(w)) || - !(boxblur->temp[1] = av_malloc(w))) + if (!(boxblur->temp[0] = av_malloc(FFMAX(w, h))) || + !(boxblur->temp[1] = av_malloc(FFMAX(w, h)))) return AVERROR(ENOMEM); boxblur->hsub = desc->log2_chroma_w; -- cgit v1.2.3