[FFmpeg-devel] [PATCH] vf_unsharp: fix out-of-buffer read

[Stefano Sabatini]

In unsharpen(), when y is >= height prevent reading from src out of
buffer, but reads from the last buffer line in src2.

The check was implemented in the original unsharp libmpcodecs code,
slso fix output discrepancy between the two filters.
---
 libavfilter/vf_unsharp.c |    6 +++++-
 1 files changed, 5 insertions(+), 1 deletions(-)

diff --git a/libavfilter/vf_unsharp.c b/libavfilter/vf_unsharp.c
index 3542ca3..2bc090f 100644
--- a/libavfilter/vf_unsharp.c
+++ b/libavfilter/vf_unsharp.c
@@ -70,6 +70,7 @@ static void unsharpen(uint8_t *dst, const uint8_t *src, int dst_stride, int src_
 
     int32_t res;
     int x, y, z;
+    const uint8_t *src2;
 
     if (!fp->amount) {
         if (dst_stride == src_stride)
@@ -84,9 +85,12 @@ static void unsharpen(uint8_t *dst, const uint8_t *src, int dst_stride, int src_
         memset(sc[y], 0, sizeof(sc[y][0]) * (width + 2 * fp->steps_x));
 
     for (y = -fp->steps_y; y < height + fp->steps_y; y++) {
+        if (y < height)
+            src2 = src;
+
         memset(sr, 0, sizeof(sr[0]) * (2 * fp->steps_x - 1));
         for (x = -fp->steps_x; x < width + fp->steps_x; x++) {
-            tmp1 = x <= 0 ? src[0] : x >= width ? src[width-1] : src[x];
+            tmp1 = x <= 0 ? src2[0] : x >= width ? src2[width-1] : src2[x];
             for (z = 0; z < fp->steps_x * 2; z += 2) {
                 tmp2 = sr[z + 0] + tmp1; sr[z + 0] = tmp1;
                 tmp1 = sr[z + 1] + tmp2; sr[z + 1] = tmp2;
-- 
1.7.2.5