From 6d9c4bd69e81b614cf1e1a809679a7ab840b2b3d Mon Sep 17 00:00:00 2001 From: Marvin Scholz Date: Tue, 2 Jul 2024 20:38:00 +0200 Subject: [PATCH] lavfi/perlin: Fix out of bounds stack buffer write An incorrect calculation in ff_perlin_init causes a write to the stack array at index 256, which is out of bounds. Fixes: CID1608711 Reviewed-by: Stefano Sabatini Signed-off-by: Michael Niedermayer --- libavfilter/perlin.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavfilter/perlin.c b/libavfilter/perlin.c index 09bae7ad33..ffad8c1e4e 100644 --- a/libavfilter/perlin.c +++ b/libavfilter/perlin.c @@ -129,7 +129,7 @@ int ff_perlin_init(FFPerlin *perlin, double period, int octaves, double persiste for (i = 0; i < 256; i++) { unsigned int random_idx = av_lfg_get(&lfg) % (256-i); uint8_t random_val = random_permutations[random_idx]; - random_permutations[random_idx] = random_permutations[256-i]; + random_permutations[random_idx] = random_permutations[255-i]; perlin->permutations[i] = perlin->permutations[i+256] = random_val; }