Skip to content

L
libyuv
Commit 37c0e648 authored by fbarchard@google.com's avatar fbarchard@google.com
Browse files
Options

Fix crash on wide images 

BUG=239
TEST=LIBYUV_WIDTH=10000 out\release\libyuv_unittest
R=changjun.yang@intel.com, johannkoenig@google.com

Review URL: https://webrtc-codereview.appspot.com/1586006

git-svn-id: http://libyuv.googlecode.com/svn/trunk@712 16f28f9a-4ce2-e073-06de-1de4eb20be90
parent 314dbf71
Hide whitespace changes
Inline Side-by-side
Showing with 30 additions and 16 deletions
README.chromium
View file @ 37c0e648
Name: libyuv
URL: http://code.google.com/p/libyuv/
Version: 711
Version: 712
License: BSD
License File: LICENSE
......
include/libyuv/version.h
View file @ 37c0e648
......@@ -11,6 +11,6 @@
#ifndef INCLUDE_LIBYUV_VERSION_H_ // NOLINT
#define INCLUDE_LIBYUV_VERSION_H_
#define LIBYUV_VERSION 711
#define LIBYUV_VERSION 712
#endif // INCLUDE_LIBYUV_VERSION_H_ NOLINT
source/convert_from.cc
View file @ 37c0e648
......@@ -886,7 +886,7 @@ int I420ToARGB1555(const uint8* src_y, int src_stride_y,
uint8* rgb_buf,
int width) = I422ToARGB1555Row_C;
#if defined(HAS_I422TOARGB1555ROW_SSSE3)
if (TestCpuFlag(kCpuHasSSSE3) && width >= 8 && width <= kMaxStride * 4) {
if (TestCpuFlag(kCpuHasSSSE3) && width >= 8 && width * 4 <= kMaxStride) {
I422ToARGB1555Row = I422ToARGB1555Row_Any_SSSE3;
if (IS_ALIGNED(width, 8)) {
I422ToARGB1555Row = I422ToARGB1555Row_SSSE3;
......@@ -937,7 +937,7 @@ int I420ToARGB4444(const uint8* src_y, int src_stride_y,
uint8* rgb_buf,
int width) = I422ToARGB4444Row_C;
#if defined(HAS_I422TOARGB4444ROW_SSSE3)
if (TestCpuFlag(kCpuHasSSSE3) && width >= 8 && width <= kMaxStride * 4) {
if (TestCpuFlag(kCpuHasSSSE3) && width >= 8 && width * 4 <= kMaxStride) {
I422ToARGB4444Row = I422ToARGB4444Row_Any_SSSE3;
if (IS_ALIGNED(width, 8)) {
I422ToARGB4444Row = I422ToARGB4444Row_SSSE3;
......@@ -989,7 +989,7 @@ int I420ToRGB565(const uint8* src_y, int src_stride_y,
#if defined(HAS_I422TORGB565ROW_SSSE3)
if (TestCpuFlag(kCpuHasSSSE3) && width >= 8
#if defined(__x86_64__) || defined(__i386__)
&& width <= kMaxStride * 4
&& width * 4 <= kMaxStride
#endif
) {
I422ToRGB565Row = I422ToRGB565Row_Any_SSSE3;
......
source/format_conversion.cc
View file @ 37c0e648
......@@ -387,6 +387,9 @@ int I420ToBayer(const uint8* src_y, int src_stride_y,
uint8* dst_bayer, int dst_stride_bayer,
int width, int height,
uint32 dst_fourcc_bayer) {
if (width * 4 > kMaxStride) {
return -1; // Size too large for row buffer
}
// Negative height means invert the image.
if (height < 0) {
height = -height;
......
source/planar_functions.cc
View file @ 37c0e648
......@@ -939,7 +939,7 @@ int NV12ToRGB565(const uint8* src_y, int src_stride_y,
uint8* rgb_buf,
int width) = NV12ToRGB565Row_C;
#if defined(HAS_NV12TORGB565ROW_SSSE3)
if (TestCpuFlag(kCpuHasSSSE3) && width >= 8 && width <= kMaxStride * 4) {
if (TestCpuFlag(kCpuHasSSSE3) && width >= 8 && width * 4 <= kMaxStride) {
NV12ToRGB565Row = NV12ToRGB565Row_Any_SSSE3;
if (IS_ALIGNED(width, 8)) {
NV12ToRGB565Row = NV12ToRGB565Row_SSSE3;
......@@ -986,7 +986,7 @@ int NV21ToRGB565(const uint8* src_y, int src_stride_y,
uint8* rgb_buf,
int width) = NV21ToRGB565Row_C;
#if defined(HAS_NV21TORGB565ROW_SSSE3)
if (TestCpuFlag(kCpuHasSSSE3) && width >= 8 && width <= kMaxStride * 4) {
if (TestCpuFlag(kCpuHasSSSE3) && width >= 8 && width * 4 <= kMaxStride) {
NV21ToRGB565Row = NV21ToRGB565Row_Any_SSSE3;
if (IS_ALIGNED(width, 8)) {
NV21ToRGB565Row = NV21ToRGB565Row_SSSE3;
......
source/rotate_argb.cc
View file @ 37c0e648
......@@ -138,9 +138,8 @@ void ARGBRotate180(const uint8* src, int src_stride,
CopyRow = CopyRow_MIPS;
}
#endif
if (width * 4 > kMaxStride) {
return;
}
bool direct = width * 4 > kMaxStride;
// Swap first and last row and mirror the content. Uses a temporary row.
SIMD_ALIGNED(uint8 row[kMaxStride]);
const uint8* src_bot = src + src_stride * (height - 1);
......@@ -148,11 +147,18 @@ void ARGBRotate180(const uint8* src, int src_stride,
int half_height = (height + 1) >> 1;
// Odd height will harmlessly mirror the middle row twice.
for (int y = 0; y < half_height; ++y) {
ARGBMirrorRow(src, row, width); // Mirror first row into a buffer
if (direct) {
ARGBMirrorRow(src, dst_bot, width); // Mirror first row into a buffer
if (src != src_bot) {
ARGBMirrorRow(src_bot, dst, width); // Mirror last row into first row
}
} else {
ARGBMirrorRow(src, row, width); // Mirror first row into a buffer
ARGBMirrorRow(src_bot, dst, width); // Mirror last row into first row
CopyRow(row, dst_bot, width * 4); // Copy first mirrored row into last
}
src += src_stride;
ARGBMirrorRow(src_bot, dst, width); // Mirror last row into first row
dst += dst_stride;
CopyRow(row, dst_bot, width * 4); // Copy first mirrored row into last
src_bot -= src_stride;
dst_bot -= dst_stride;
}
......
source/scale.cc
View file @ 37c0e648
......@@ -2299,7 +2299,8 @@ int I420Scale(const uint8* src_y, int src_stride_y,
int dst_width, int dst_height,
FilterMode filtering) {
if (!src_y || !src_u || !src_v || src_width == 0 || src_height == 0 ||
!dst_y || !dst_u || !dst_v || dst_width <= 0 || dst_height <= 0) {
!dst_y || !dst_u || !dst_v || dst_width <= 0 || dst_height <= 0 ||
src_width > 32767 || src_height > 32767) {
return -1;
}
// Negative height means invert the image.
......@@ -2362,7 +2363,8 @@ int Scale(const uint8* src_y, const uint8* src_u, const uint8* src_v,
int dst_width, int dst_height,
bool interpolate) {
if (!src_y || !src_u || !src_v || src_width <= 0 || src_height == 0 ||
!dst_y || !dst_u || !dst_v || dst_width <= 0 || dst_height <= 0) {
!dst_y || !dst_u || !dst_v || dst_width <= 0 || dst_height <= 0 ||
src_width > 32767 || src_height > 32767) {
return -1;
}
// Negative height means invert the image.
......@@ -2423,6 +2425,7 @@ int ScaleOffset(const uint8* src, int src_width, int src_height,
bool interpolate) {
if (!src || src_width <= 0 || src_height <= 0 ||
!dst || dst_width <= 0 || dst_height <= 0 || dst_yoffset < 0 ||
src_width > 32767 || src_height > 32767 ||
dst_yoffset >= dst_height) {
return -1;
}
......
source/scale_argb.cc
View file @ 37c0e648
......@@ -1163,6 +1163,7 @@ int ARGBScaleClip(const uint8* src_argb, int src_stride_argb,
if (!src_argb || src_width == 0 || src_height == 0 ||
!dst_argb || dst_width <= 0 || dst_height <= 0 ||
clip_x < 0 || clip_y < 0 ||
src_width > 32767 || src_height > 32767 ||
(clip_x + clip_width) > dst_width ||
(clip_y + clip_height) > dst_height) {
return -1;
......@@ -1181,7 +1182,8 @@ int ARGBScale(const uint8* src_argb, int src_stride_argb,
int dst_width, int dst_height,
FilterMode filtering) {
if (!src_argb || src_width == 0 || src_height == 0 ||
!dst_argb || dst_width <= 0 || dst_height <= 0) {
!dst_argb || dst_width <= 0 || dst_height <= 0 ||
src_width > 32767 || src_height > 32767) {
return -1;
}
ScaleARGB(src_argb, src_stride_argb, src_width, src_height,
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment