From 12ca9b6890144346290917bca27ba859b82b5f72 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 15 Oct 2026 04:06:26 +0200 Subject: [PATCH] avfilter/vf_pad: do the x/y range check and centering in 64bit Fixes: Ilayk1MzOixN Fixes: swarm-Signed-integer-overflow-in-pad-x-y-bounds-check-499261 Regression since: 57c3670896 Signed integer overflow Replicated through UnModified FFmpeg with UBSAN Found-by: zhang xingxing <2388969553@qq.com> The report suggested, among other options, widening the comparison. The overflow in the centering was found during review of the fixes for the report. Signed-off-by: Michael Niedermayer --- libavfilter/vf_pad.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libavfilter/vf_pad.c b/libavfilter/vf_pad.c index a3436bb2d6..4891cf2518 100644 --- a/libavfilter/vf_pad.c +++ b/libavfilter/vf_pad.c @@ -180,10 +180,10 @@ static int config_input(AVFilterLink *inlink) goto eval_fail; s->x = var_values[VAR_X] = res; - if (s->x < 0 || s->x + inlink->w > s->w) - s->x = var_values[VAR_X] = (s->w - inlink->w) / 2; - if (s->y < 0 || s->y + inlink->h > s->h) - s->y = var_values[VAR_Y] = (s->h - inlink->h) / 2; + if (s->x < 0 || (int64_t)s->x + inlink->w > s->w) + s->x = var_values[VAR_X] = ((int64_t)s->w - inlink->w) / 2; + if (s->y < 0 || (int64_t)s->y + inlink->h > s->h) + s->y = var_values[VAR_Y] = ((int64_t)s->h - inlink->h) / 2; s->w = ff_draw_round_to_sub(&s->draw, 0, -1, s->w); s->h = ff_draw_round_to_sub(&s->draw, 1, -1, s->h);