Commit b30a035bfa for ffmpeg

commit b30a035bfa0c717c44a93f9d6062a211b11bdbd4
Author: yongdev <yongdev@google.com>
Date:   Mon Aug 17 17:20:43 2026 +0000

    libswscale/ppc/swscale_vsx: fix heap buffer overflow in WRITERGB for RGB24/BGR24

    In WRITERGB for AV_PIX_FMT_RGB24 and AV_PIX_FMT_BGR24, vec_vsx_st(out1, 16, dest)
    performs a 16-byte vector store starting at offset 16 (writing 32 bytes in total
    into dest). Because RGB24/BGR24 pixels require only 24 bytes per iteration, the
    16-byte write overshoots by 8 bytes, causing an out-of-bounds heap buffer overflow
    on the trailing slice pixels.

    Fix this by storing out1 into an aligned temporary buffer and copying only the
    remaining 8 bytes to dest + 16 via memcpy, preventing the 8-byte buffer overrun.

    Signed-off-by: yongdev <yongdev@google.com>

diff --git a/libswscale/ppc/swscale_vsx.c b/libswscale/ppc/swscale_vsx.c
index 35c0032b47..b4725de174 100644
--- a/libswscale/ppc/swscale_vsx.c
+++ b/libswscale/ppc/swscale_vsx.c
@@ -456,28 +456,32 @@ yuv2NBPSX(16, LE, 0, 16, int32_t)
         bd = vec_packsu(bd16, zero16); \
 \
         switch(target) { \
-        case AV_PIX_FMT_RGB24: \
+        case AV_PIX_FMT_RGB24: { \
+            DECLARE_ALIGNED(16, uint8_t, tmp_out)[16]; \
             out0 = vec_perm(rd, gd, perm3rg0); \
             out0 = vec_perm(out0, bd, perm3tb0); \
             out1 = vec_perm(rd, gd, perm3rg1); \
             out1 = vec_perm(out1, bd, perm3tb1); \
 \
             vec_vsx_st(out0, 0, dest); \
-            vec_vsx_st(out1, 16, dest); \
+            vec_vsx_st(out1, 0, tmp_out); \
+            memcpy(dest + 16, tmp_out, 8); \
 \
             dest += 24; \
-        break; \
-        case AV_PIX_FMT_BGR24: \
+        break; } \
+        case AV_PIX_FMT_BGR24: { \
+            DECLARE_ALIGNED(16, uint8_t, tmp_out)[16]; \
             out0 = vec_perm(bd, gd, perm3rg0); \
             out0 = vec_perm(out0, rd, perm3tb0); \
             out1 = vec_perm(bd, gd, perm3rg1); \
             out1 = vec_perm(out1, rd, perm3tb1); \
 \
             vec_vsx_st(out0, 0, dest); \
-            vec_vsx_st(out1, 16, dest); \
+            vec_vsx_st(out1, 0, tmp_out); \
+            memcpy(dest + 16, tmp_out, 8); \
 \
             dest += 24; \
-        break; \
+        break; } \
         case AV_PIX_FMT_BGRA: \
             out0 = vec_mergeh(bd, gd); \
             out1 = vec_mergeh(rd, ad); \