zimg: fix abort on subsampled input with odd heights

We make the assumption that there is more buffer available
than indicated, this needs to be considered in this specific
location too as mp_image_crop understandably checks whether
we're about to do something unsafe.

minimal reproducer: mpv av://lavfi:testsrc -vf crop=320:239,format=yuv420p -o test.png

fixes #10469

1 files changed, 8 insertions, 1 deletions

diff --git a/video/zimg.c b/video/zimg.c
index c3560a0ff7..be2953c58c 100644
--- a/video/zimg.c
+++ b/video/zimg.c
@@ -268,7 +268,14 @@ static bool wrap_buffer(struct mp_zimg_state *st, struct mp_zimg_repack *r,
     if (r->pack) {
         mpi = &r->cropped_tmp;
         *mpi = *a_mpi;
-        mp_image_crop(mpi, 0, st->slice_y, mpi->w, st->slice_y + st->slice_h);
+        int y1 = st->slice_y + st->slice_h;
+        // Due to subsampling we may assume the image to be bigger than it
+        // actually is (see real_h in setup_format).
+        if (mpi->h < y1) {
+            assert(y1 - mpi->h < 4);
+            mp_image_set_size(mpi, mpi->w, y1);
+        }
+        mp_image_crop(mpi, 0, st->slice_y, mpi->w, y1);
     }
 
     bool direct[MP_MAX_PLANES] = {0};