FixLuminance accepts zero slope before division

[msg7086]

Analysis attribution: This issue analysis was created by Codex GPT.
The GitHub user who submits this issue does not claim authorship of the analysis.

Finding

• Finding ID: B11-fix-luminance-zero-slope
• Status: Reproduced defect
• Severity: High
• Affected component: FixLuminance
• Source location: avs_core/filters/misc.cpp:66-87

Summary

The constructor accepts slope=0, and GetFrame divides by that value.

Affected Code

FixLuminance::FixLuminance(PClip _child, int _vertex, int _slope, IScriptEnvironment* env)
 : GenericVideoFilter(_child), vertex(_vertex), slope(_slope)
{
  if (!vi.IsYUY2())
    env->ThrowError("FixLuminance: requires YUY2 input");
}

PVideoFrame FixLuminance::GetFrame(int n, IScriptEnvironment* env)
{
  PVideoFrame frame = child->GetFrame(n, env);
  env->MakeWritable(&frame);
  BYTE* p = frame->GetWritePtr();
  const int pitch = frame->GetPitch();
  for (int y=0; y<=vertex-slope/16; ++y)
  {
    const int subtract = (vertex-y)*16/slope;
    for (int x=0; x<vi.width; ++x)
      p[x*2] = (BYTE)max(0, p[x*2]-subtract);
    p += pitch;
  }
  return frame;
}

Correct Behavior

Reject a zero slope during construction with AvisynthError, before a frame is requested or modified.

Reproduction

Create a one-frame YUY2 clip and construct FixLuminance(clip, vertex=1, slope=0).

Observed Result

observed: construction succeeds
expected: AvisynthError for slope=0

Impact

A public filter accepts a parameter that makes its frame-processing arithmetic undefined. Evaluating the returned clip reaches an integer division by zero after the input frame has been made writable.

Validation Criteria

Construction with zero slope throws AvisynthError without requesting or modifying an input frame. Existing nonzero-slope behavior remains unchanged.

Version and Environment

• AviSynthPlus revision: 815780226951f95dfc1fcf74f1df90ef98824fcf5
• Platform and compiler: Linux x86_64 / Clang 22 debug
• CPU features used: host-default build.