lavfi/bwdif: fix heap-buffer-overflow with small height videos
authorJun Zhao <barryjzhao@tencent.com>
Sun, 25 Jan 2026 02:31:48 +0000 (10:31 +0800)
committerMichael Niedermayer <michael@niedermayer.cc>
Sun, 21 Jun 2026 15:59:33 +0000 (17:59 +0200)
commit9bca18ebcd818b9d26f1ed298d18ffe0890f4dd6
tree6489189370a045536ebb8ae7cd39967b9cc69bc1
parenta19e69435b134fe3f11dec3ee97ee79fea156568
lavfi/bwdif: fix heap-buffer-overflow with small height videos

Reproduce:
  ffmpeg -i /tmp/bwdif_test_input_160x4_gray16.jpg -vf "bwdif" -f null -

filter_intra accesses rows 3 lines away via cur[mrefs3] and cur[prefs3].
For small height videos (h <= 4), this causes heap-buffer-overflow.

Add boundary check for filter_intra when YADIF_FIELD_END is set.
The boundary condition (y < 3) or (y + 3 >= td->h) precisely matches
filter_intra's 3-line context requirement.

Test file: 160x4 gray16 JPEG
https://code.ffmpeg.org/attachments/db2ace24-bc00-4af6-a53a-5df6b0d51b15

fix #21570

Reviewed-by: Thomas Mundt <tmundt75@gmail.com>
Signed-off-by: Jun Zhao <barryjzhao@tencent.com>
(cherry picked from commit 795bccdaf57772b1803914dee2f32d52776518e2)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit fdfe4d2cfb91bf4f81b3058e1f4b54a2afe8a622)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavfilter/vf_bwdif.c