File ffmpeg-CVE-2020-22021.patch of Package ffmpeg.27460
diff --unified --recursive --text --new-file --color ffmpeg-3.4.2.old/libavfilter/vf_yadif.c ffmpeg-3.4.2.new/libavfilter/vf_yadif.c
--- ffmpeg-3.4.2.old/libavfilter/vf_yadif.c 2021-06-02 15:52:46.082175501 +0800
+++ ffmpeg-3.4.2.new/libavfilter/vf_yadif.c 2021-06-09 10:16:04.055240754 +0800
@@ -123,19 +123,23 @@
uint8_t *prev2 = parity ? prev : cur ;
uint8_t *next2 = parity ? cur : next;
+ const int edge = MAX_ALIGN - 1;
+ int offset = FFMAX(w - edge, 3);
+
/* Only edge pixels need to be processed here. A constant value of false
* for is_not_edge should let the compiler ignore the whole branch. */
- FILTER(0, 3, 0)
+ FILTER(0, FFMIN(3, w), 0)
- dst = (uint8_t*)dst1 + w - (MAX_ALIGN-1);
- prev = (uint8_t*)prev1 + w - (MAX_ALIGN-1);
- cur = (uint8_t*)cur1 + w - (MAX_ALIGN-1);
- next = (uint8_t*)next1 + w - (MAX_ALIGN-1);
+ dst = (uint8_t*)dst1 + offset;
+ prev = (uint8_t*)prev1 + offset;
+ cur = (uint8_t*)cur1 + offset;
+ next = (uint8_t*)next1 + offset;
prev2 = (uint8_t*)(parity ? prev : cur);
next2 = (uint8_t*)(parity ? cur : next);
- FILTER(w - (MAX_ALIGN-1), w - 3, 1)
- FILTER(w - 3, w, 0)
+ FILTER(offset, w - 3, 1)
+ offset = FFMAX(offset, w - 3);
+ FILTER(offset, w, 0)
}
@@ -167,20 +171,25 @@
int x;
uint16_t *prev2 = parity ? prev : cur ;
uint16_t *next2 = parity ? cur : next;
+
+ const int edge = MAX_ALIGN / 2 - 1;
+ int offset = FFMAX(w - edge, 3);
+
mrefs /= 2;
prefs /= 2;
- FILTER(0, 3, 0)
+ FILTER(0, FFMIN(3, w), 0)
- dst = (uint16_t*)dst1 + w - (MAX_ALIGN/2-1);
- prev = (uint16_t*)prev1 + w - (MAX_ALIGN/2-1);
- cur = (uint16_t*)cur1 + w - (MAX_ALIGN/2-1);
- next = (uint16_t*)next1 + w - (MAX_ALIGN/2-1);
+ dst = (uint16_t*)dst1 + offset;
+ prev = (uint16_t*)prev1 + offset;
+ cur = (uint16_t*)cur1 + offset;
+ next = (uint16_t*)next1 + offset;
prev2 = (uint16_t*)(parity ? prev : cur);
next2 = (uint16_t*)(parity ? cur : next);
- FILTER(w - (MAX_ALIGN/2-1), w - 3, 1)
- FILTER(w - 3, w, 0)
+ FILTER(offset, w - 3, 1)
+ offset = FFMAX(offset, w - 3);
+ FILTER(offset, w, 0)
}
static int filter_slice(AVFilterContext *ctx, void *arg, int jobnr, int nb_jobs)