[PR] libavutil/x86/imgutils_init: add integer overflow and SSE alignment checks in ff_image_copy_plane_uc_from_x86 (PR #24220)

PR #24220 opened by yongdev
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24220
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24220.patch

In ff_image_copy_plane_uc_from_x86, FFALIGN(bytewidth, 64) is evaluated directly
without validating whether bytewidth or height are non-positive or if bytewidth + 63
causes ptrdiff_t integer overflow. Furthermore, the SSE4 vector copy routines
require 16-byte aligned source and destination pointers.

Add boundary validation for non-positive dimensions, guard against ptrdiff_t overflow
before FFALIGN, and ensure src and dst satisfy 16-byte SSE alignment requirements,
returning AVERROR(ENOSYS) to gracefully fall back to the generic C implementation
when unaligned.

Signed-off-by: yongdev <[email protected]>

# Summary of changes

Briefly describe what this PR does and why.

<!--
If this PR requires new FATE test samples, attach them to the PR and
list their target paths below (relative to the fate-suite root).

Attached filenames must match the sample's filename:

```fate-samples
# e.g. vorbis/new-sample.ogg
```
-->



>From 38ce836344f73f140c2923d065ed1dbb65037a72 Mon Sep 17 00:00:00 2001
From: yongdev <[email protected]>
Date: Mon, 17 Aug 2026 18:16:50 +0000
Subject: [PATCH] libavutil/x86/imgutils_init: add integer overflow and SSE
 alignment checks in ff_image_copy_plane_uc_from_x86

In ff_image_copy_plane_uc_from_x86, FFALIGN(bytewidth, 64) is evaluated directly
without validating whether bytewidth or height are non-positive or if bytewidth + 63
causes ptrdiff_t integer overflow. Furthermore, the SSE4 vector copy routines
require 16-byte aligned source and destination pointers.

Add boundary validation for non-positive dimensions, guard against ptrdiff_t overflow
before FFALIGN, and ensure src and dst satisfy 16-byte SSE alignment requirements,
returning AVERROR(ENOSYS) to gracefully fall back to the generic C implementation
when unaligned.

Signed-off-by: yongdev <[email protected]>
---
 libavutil/x86/imgutils_init.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/libavutil/x86/imgutils_init.c b/libavutil/x86/imgutils_init.c
index 91a16cf594..f202fe4832 100644
--- a/libavutil/x86/imgutils_init.c
+++ b/libavutil/x86/imgutils_init.c
@@ -35,7 +35,16 @@ int ff_image_copy_plane_uc_from_x86(uint8_t       *dst, ptrdiff_t dst_linesize,
                                     ptrdiff_t bytewidth, int height)
 {
     int cpu_flags = av_get_cpu_flags();
-    ptrdiff_t bw_aligned = FFALIGN(bytewidth, 64);
+    ptrdiff_t bw_aligned;
+
+    if (bytewidth <= 0 || height <= 0)
+        return 0;
+
+    if (bytewidth > PTRDIFF_MAX - 63 ||
+        ((uintptr_t)src & 15) != 0 || ((uintptr_t)dst & 15) != 0)
+        return AVERROR(ENOSYS);
+
+    bw_aligned = FFALIGN(bytewidth, 64);
 
     if (EXTERNAL_SSE4(cpu_flags) &&
         bw_aligned <= dst_linesize && bw_aligned <= src_linesize)
-- 
2.52.0

_______________________________________________
ffmpeg-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]