Commit 184f89e1b4 for ffmpeg
commit 184f89e1b4ad416bdfd795917dc356346d88f36e
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri Nov 6 03:52:54 2026 +0100
avfilter/vf_w3fdif: reject chroma planes of less than 2 lines
Fixes: heap-buffer-overflow
Fixes: QVQGy0DTFsYd
Found-by: SecBuddyF, Tencent KeenLab (CodeBuddy Security)
Heap out of array read Replicated through UnModified FFmpeg with ASAN
diff --git a/libavfilter/vf_w3fdif.c b/libavfilter/vf_w3fdif.c
index 465453db25..73a8168284 100644
--- a/libavfilter/vf_w3fdif.c
+++ b/libavfilter/vf_w3fdif.c
@@ -288,6 +288,11 @@ static int config_input(AVFilterLink *inlink)
return AVERROR(EINVAL);
}
+ if (s->planeheight[1] < 2) {
+ av_log(ctx, AV_LOG_ERROR, "Video with chroma planes of less than 2 lines is not supported\n");
+ return AVERROR(EINVAL);
+ }
+
s->nb_planes = av_pix_fmt_count_planes(inlink->format);
nb_threads = ff_filter_get_nb_threads(ctx);
s->work_line = av_calloc(nb_threads, sizeof(*s->work_line));