Commit dec1770703 for ffmpeg
commit dec1770703b7c19ba6bbc30049275301cd4c8a2f
Author: romainhedouin <romain.hedouin@epitech.eu>
Date: Fri Oct 16 16:35:47 2026 +0200
avfilter/vf_nnedi: fix a heap overflow in the prescreener buffer
process_new() writes the prescreener flags four at a time, but the
buffer was only as wide as the plane. If the width is not a multiple
of four, up to three flags were written past the end of it.
Found with ASan using the default settings, for example on gray
321x120.
Found during a code review sweep of ffmpeg using an LLM.
Signed-off-by: romainhedouin <romain.hedouin@epitech.eu>
diff --git a/libavfilter/vf_nnedi.c b/libavfilter/vf_nnedi.c
index 148791f804..8deba18b0c 100644
--- a/libavfilter/vf_nnedi.c
+++ b/libavfilter/vf_nnedi.c
@@ -1096,7 +1096,7 @@ static int config_input(AVFilterLink *inlink)
return AVERROR(ENOMEM);
for (int i = 0; i < s->nb_threads; i++) {
- s->prescreen_buf[i] = av_calloc(s->planewidth[0], sizeof(**s->prescreen_buf));
+ s->prescreen_buf[i] = av_calloc(FFALIGN(s->planewidth[0], 4), sizeof(**s->prescreen_buf));
if (!s->prescreen_buf[i])
return AVERROR(ENOMEM);
}