ffmpeg-7/ffmpeg-7-CVE-2024-32229.patch

From a528a54ee119dcba47e7c9e30d3a56206fbad416 Mon Sep 17 00:00:00 2001
From: James Almer <jamrial@gmail.com>
Date: Thu, 4 Jul 2024 14:55:23 -0300
Subject: [PATCH] avfilter/vf_tiltandshift: fix buffer offset for yuv422p input

Fixes ticket #10950.

Signed-off-by: James Almer <jamrial@gmail.com>
---
 libavfilter/vf_tiltandshift.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/libavfilter/vf_tiltandshift.c b/libavfilter/vf_tiltandshift.c
index 85cce84fc3..b49a713339 100644
--- a/libavfilter/vf_tiltandshift.c
+++ b/libavfilter/vf_tiltandshift.c
@@ -175,14 +175,14 @@ static void copy_column(AVFilterLink *outlink,
     const uint8_t *src[4];
 
     dst[0] = dst_data[0] + ncol;
-    dst[1] = dst_data[1] + (ncol >> s->desc->log2_chroma_h);
-    dst[2] = dst_data[2] + (ncol >> s->desc->log2_chroma_h);
+    dst[1] = dst_data[1] + (ncol >> s->desc->log2_chroma_w);
+    dst[2] = dst_data[2] + (ncol >> s->desc->log2_chroma_w);
 
     if (!tilt)
         ncol = 0;
     src[0] = src_data[0] + ncol;
-    src[1] = src_data[1] + (ncol >> s->desc->log2_chroma_h);
-    src[2] = src_data[2] + (ncol >> s->desc->log2_chroma_h);
+    src[1] = src_data[1] + (ncol >> s->desc->log2_chroma_w);
+    src[2] = src_data[2] + (ncol >> s->desc->log2_chroma_w);
 
     av_image_copy(dst, dst_linesizes, src, src_linesizes, outlink->format, 1, outlink->h);
 }
-- 
2.41.0