avfilter/vf_sr: fix read out of bounds
authorZhao Zhili <quinkblack@foxmail.com>
Wed, 19 Sep 2018 02:55:11 +0000 (10:55 +0800)
committerPedro Arthur <bygrandao@gmail.com>
Wed, 19 Sep 2018 16:21:27 +0000 (13:21 -0300)
Signed-off-by: Pedro Arthur <bygrandao@gmail.com>
libavfilter/vf_sr.c

index 8a77a1d..c1ae6c5 100644 (file)
@@ -227,7 +227,8 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
                   0, sr_context->sws_slice_h, out->data, out->linesize);
 
         sws_scale(sr_context->sws_contexts[1], (const uint8_t **)out->data, out->linesize,
-                  0, out->height, (uint8_t * const*)(&sr_context->input.data), &sr_context->sws_input_linesize);
+                  0, out->height, (uint8_t * const*)(&sr_context->input.data),
+                  (const int [4]){sr_context->sws_input_linesize, 0, 0, 0});
     }
     else{
         if (sr_context->sws_contexts[0]){
@@ -238,7 +239,8 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
         }
 
         sws_scale(sr_context->sws_contexts[1], (const uint8_t **)in->data, in->linesize,
-                  0, in->height, (uint8_t * const*)(&sr_context->input.data), &sr_context->sws_input_linesize);
+                  0, in->height, (uint8_t * const*)(&sr_context->input.data),
+                  (const int [4]){sr_context->sws_input_linesize, 0, 0, 0});
     }
     av_frame_free(&in);
 
@@ -248,7 +250,8 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *in)
         return AVERROR(EIO);
     }
 
-    sws_scale(sr_context->sws_contexts[2], (const uint8_t **)(&sr_context->output.data), &sr_context->sws_output_linesize,
+    sws_scale(sr_context->sws_contexts[2], (const uint8_t **)(&sr_context->output.data),
+              (const int[4]){sr_context->sws_output_linesize, 0, 0, 0},
               0, out->height, (uint8_t * const*)out->data, out->linesize);
 
     return ff_filter_frame(outlink, out);