avfilter/vf_fieldorder: fix heap-buffer overflow

Fixes #8264

diff --git a/libavfilter/vf_fieldorder.c b/libavfilter/vf_fieldorder.c
index ca55ff1f668a248dcf0255df3e1c6b19fe8c6b9c..5707151f1beeb421de35b2bc75640d417fbb09ac 100644 (file)
--- a/libavfilter/vf_fieldorder.c
+++ b/libavfilter/vf_fieldorder.c
@@ -108,8 +108,8 @@ static int filter_frame(AVFilterLink *inlink, AVFrame *frame)
             s->dst_tff ? "up" : "down");
     h = frame->height;
     for (plane = 0; plane < 4 && frame->data[plane] && frame->linesize[plane]; plane++) {
-        dst_line_step = out->linesize[plane];
-        src_line_step = frame->linesize[plane];
+        dst_line_step = out->linesize[plane] * (h > 2);
+        src_line_step = frame->linesize[plane] * (h > 2);
         line_size = s->line_size[plane];
         dst = out->data[plane];
         src = frame->data[plane];