From b7ded5138268cc502028304b28ad698944aa7d59 Mon Sep 17 00:00:00 2001 From: Nicolas Dufresne Date: Tue, 19 Apr 2022 11:05:05 -0400 Subject: [PATCH] video: Fix possible overrun when iterating comp[] array Fix 2 iterations that can overrun the array if the number of component is equal to the size of the array. Part-of: --- subprojects/gst-plugins-base/gst-libs/gst/video/video-format.c | 2 +- subprojects/gst-plugins-base/gst-libs/gst/video/video-frame.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/subprojects/gst-plugins-base/gst-libs/gst/video/video-format.c b/subprojects/gst-plugins-base/gst-libs/gst/video/video-format.c index 09a5776..286051f 100644 --- a/subprojects/gst-plugins-base/gst-libs/gst/video/video-format.c +++ b/subprojects/gst-plugins-base/gst-libs/gst/video/video-format.c @@ -7743,7 +7743,7 @@ gst_video_format_info_extrapolate_stride (const GstVideoFormatInfo * finfo, * number of component on the first plane against the number of component on * the current plane. */ estride = 0; - for (i = 0; comp[i] >= 0; i++) + for (i = 0; i < GST_VIDEO_MAX_COMPONENTS && comp[i] >= 0; i++) estride += GST_VIDEO_FORMAT_INFO_SCALE_WIDTH (finfo, comp[i], stride); return estride; diff --git a/subprojects/gst-plugins-base/gst-libs/gst/video/video-frame.c b/subprojects/gst-plugins-base/gst-libs/gst/video/video-frame.c index d920912..cbd6369 100644 --- a/subprojects/gst-plugins-base/gst-libs/gst/video/video-frame.c +++ b/subprojects/gst-plugins-base/gst-libs/gst/video/video-frame.c @@ -294,7 +294,7 @@ scale_tile_shifts (const GstVideoFormatInfo * finfo, gint plane, guint * ws, /* for each additional component in the same plane, double the tile width, * this should provide the appropriate tile size when the tile size varies * base on the subsampling. */ - for (i = 1; comp[i] >= 0; i++) + for (i = 1; i < GST_VIDEO_MAX_COMPONENTS && comp[i] >= 0; i++) *ws += 1; } -- 2.7.4