Commit 27f61c0ff5 for ffmpeg
commit 27f61c0ff5d1f96b54b3e45290c003c608f70773
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Mon Oct 12 02:28:10 2026 +0200
avfilter/vf_idet: use the linesize of the previous and next frame
Fixes: out of array read
Fixes: Au41rSBM5kGS
Found during triage of the review of https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24765
Out of array read Replicated through UnModified FFmpeg with ASAN
diff --git a/libavfilter/vf_idet.c b/libavfilter/vf_idet.c
index c217021ae9..02dc14fb7a 100644
--- a/libavfilter/vf_idet.c
+++ b/libavfilter/vf_idet.c
@@ -156,9 +156,9 @@ static void filter(AVFilterContext *ctx)
}
for (y = 2; y < h - 2; y++) {
- uint8_t *prev = &idet->prev->data[i][y*refs];
+ uint8_t *prev = &idet->prev->data[i][y*idet->prev->linesize[i]];
uint8_t *cur = &idet->cur ->data[i][y*refs];
- uint8_t *next = &idet->next->data[i][y*refs];
+ uint8_t *next = &idet->next->data[i][y*idet->next->linesize[i]];
alpha[ y &1] += filter_line(cur-refs, prev, cur+refs, w);
alpha[(y^1)&1] += filter_line(cur-refs, next, cur+refs, w);
delta += filter_line(cur-refs, cur, cur+refs, w);