Change #269207

Comments

swscale/ops_dispatch: calculate correct slice line count for tail copy
These loops were both assuming that `h` lines need to be copied; but this
varies. First of all, for plane subsampling; but more importantly, when
vertically scaling, the input line count may be substantially lower than the
actual line count.

This fixes an out-of-bounds read/write when vertically upscaling with a tail
buffer.

Verifiable via e.g.:
  make libswscale/tests/swscale
  valgrind -- libswscale/tests/swscale -s 63x63 -src yuv444p -dst rgb24 \
              -flags unstable -align_src 1 -align_dst 1

(As well as the SSIM scores, which drop from ~e-5 to ~e-3 without this fix)

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Niklas Haas <git@haasn.dev>

Changed files

• libswscale/ops_dispatch.c