Commit d5f2e3ef8e for ffmpeg
commit d5f2e3ef8e049cb3c17e06e1c39b6cfb571b9e7c
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Fri Nov 6 03:52:55 2026 +0100
avfilter/vf_selectivecolor: check the correction method read from the psfile
Fixes: out of array read
Fixes: urb6qL5xnaVD
Fixes: swarm-Unvalidated-correction_method-from-psfile-causes-OOB-function-pointer-read-f780a0
Found-by: zhang xingxing <2388969553@qq.com>
The same check was suggested in the report.
Out of array read Replicated through UnModified FFmpeg with ASAN and UBSAN
diff --git a/libavfilter/vf_selectivecolor.c b/libavfilter/vf_selectivecolor.c
index 4fa8b32f3c..6d27bdacb0 100644
--- a/libavfilter/vf_selectivecolor.c
+++ b/libavfilter/vf_selectivecolor.c
@@ -210,6 +210,10 @@ static int parse_psfile(AVFilterContext *ctx, const char *fname)
"the settings might not be loaded properly\n", version);
READ16(s->correction_method);
+ if (s->correction_method >= NB_CORRECTION_METHODS) {
+ ret = AVERROR_INVALIDDATA;
+ goto end;
+ }
// 1st CMYK entry is reserved/unused
for (i = 0; i < FF_ARRAY_ELEMS(s->cmyk_adjust[0]); i++) {