Change #271213

Comments

avcodec/snowenc: fix out-of-bounds memcpy in get_block_rd() for narrow planes
For an edge block, get_block_rd() copies the full-OBMC-weight central
region directly from cur[] into the reconstruction.  It moved one
boundary to block_w/block_h but overwrote the in-plane clip (x0/x1/y0/y1
computed earlier from the plane size) instead of intersecting with it.
When a plane is narrower than block_w - e.g. a tiny field/chroma plane
produced by the mcdeint filter - the right-edge case left x0 = block_w
while x1 stayed clipped to w - sx < block_w, so x1 - x0 became negative
and was passed to memcpy() as a huge size_t, crashing with SIGSEGV.

Intersect the moved boundaries with the existing clip so the copy region
stays inside the plane and the memcpy length can never be negative.

Reproducible with the GPL mcdeint filter in slow/extra_slow mode, e.g.

    ffmpeg -f lavfi -i testsrc=s=5x32 -vf mcdeint=mode=slow -f null -

This is a separate crash from the get_dc() SIGFPE (ticket #7779) reached
through the same iterative_me() path.  Add a lavfi-based FATE regression
test.

Signed-off-by: Bogdan Lisman <bogdan@pydevsolutions.com>

Changed files

• libavcodec/snowenc.c
• tests/fate/filter-video.mak
• tests/ref/fate/filter-mcdeint-slow-edge