Commit 9a33f26385 for ffmpeg
commit 9a33f263855111b545ec29cf31c5da475f2b0f31
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue Sep 22 00:30:20 2026 +0200
avfilter/vf_bm3d: reject planes smaller than the block size
Found-by: zhang xingxing <2388969553@qq.com>
Suggested-by: zhang xingxing <2388969553@qq.com>
Fixes: out of array read
Fixes: 5GvFWV0LII0w
diff --git a/libavfilter/vf_bm3d.c b/libavfilter/vf_bm3d.c
index 16f4d98ac6..b278d16681 100644
--- a/libavfilter/vf_bm3d.c
+++ b/libavfilter/vf_bm3d.c
@@ -776,6 +776,15 @@ static int config_input(AVFilterLink *inlink)
s->pblock_size = FFALIGN(s->block_size * 2, av_cpu_max_align());
s->pgroup_size = FFALIGN(s->group_size * 2, av_cpu_max_align());
+ for (int p = 0; p < s->nb_planes; p++) {
+ if (!((1 << p) & s->planes))
+ continue;
+ if (s->planewidth[p] < s->block_size || s->planeheight[p] < s->block_size) {
+ av_log(ctx, AV_LOG_ERROR, "Plane %d is smaller than the block size\n", p);
+ return AVERROR(EINVAL);
+ }
+ }
+
for (int i = 0; i < s->nb_threads; i++) {
SliceContext *sc = &s->slices[i];
float iscale = 0.5f / s->block_size;