avfilter/vf_vmafmotion: Check dimensions
authorMichael Niedermayer <michael@niedermayer.cc>
Sat, 29 May 2021 07:58:31 +0000 (09:58 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Sat, 29 May 2021 18:14:24 +0000 (20:14 +0200)
Fixes: out of array access
Fixes: Ticket8241
Fixes: Ticket8246
Fixes: CVE-2020-22019
Fixes: CVE-2020-22033

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavfilter/vf_vmafmotion.c

index 2db4783..454ebb8 100644 (file)
@@ -238,6 +238,9 @@ int ff_vmafmotion_init(VMAFMotionData *s,
     int i;
     const AVPixFmtDescriptor *desc = av_pix_fmt_desc_get(fmt);
 
+    if (w < 3 || h < 3)
+        return AVERROR(EINVAL);
+
     s->width = w;
     s->height = h;
     s->stride = FFALIGN(w * sizeof(uint16_t), 32);