Commit 6044cf950a for ffmpeg
commit 6044cf950ab7f436d3b1a5589150aacd2e8e869e
Author: romainhedouin <romain.hedouin@epitech.eu>
Date: Fri Oct 16 16:35:47 2026 +0200
avfilter/vf_nnedi: fix out of bounds reads on narrow planes
read_bytes() and read_words() pad each line with 32 mirrored samples
on both sides. For a plane narrower than 32 samples they read before
the start and past the end of the line. Clamp the indices. The output
for wider planes is unchanged.
Found with ASan on gray 16x16 and on the chroma of yuv420p 48x32.
Found during a code review sweep of ffmpeg using an LLM.
Signed-off-by: romainhedouin <romain.hedouin@epitech.eu>
diff --git a/libavfilter/vf_nnedi.c b/libavfilter/vf_nnedi.c
index 8deba18b0c..5c4b47e0a2 100644
--- a/libavfilter/vf_nnedi.c
+++ b/libavfilter/vf_nnedi.c
@@ -445,13 +445,13 @@ static void read_bytes(const uint8_t *src, float *dst,
{
for (int y = 0; y < height; y++) {
for (int x = 0; x < 32; x++)
- dst[-x - 1] = src[x];
+ dst[-x - 1] = src[FFMIN(x, width - 1)];
for (int x = 0; x < width; x++)
dst[x] = src[x];
for (int x = 0; x < 32; x++)
- dst[width + x] = src[width - x - 1];
+ dst[width + x] = src[FFMAX(width - x - 1, 0)];
dst += dst_stride;
src += src_stride;
@@ -468,13 +468,13 @@ static void read_words(const uint8_t *srcp, float *dst,
for (int y = 0; y < height; y++) {
for (int x = 0; x < 32; x++)
- dst[-x - 1] = src[x] * scale;
+ dst[-x - 1] = src[FFMIN(x, width - 1)] * scale;
for (int x = 0; x < width; x++)
dst[x] = src[x] * scale;
for (int x = 0; x < 32; x++)
- dst[width + x] = src[width - x - 1] * scale;
+ dst[width + x] = src[FFMAX(width - x - 1, 0)] * scale;
dst += dst_stride;
src += src_stride;