Fix crash on wide images

BUG=239
TEST=LIBYUV_WIDTH=10000 out\release\libyuv_unittest
R=changjun.yang@intel.com, johannkoenig@google.com

Review URL: https://webrtc-codereview.appspot.com/1586006

git-svn-id: http://libyuv.googlecode.com/svn/trunk@712 16f28f9a-4ce2-e073-06de-1de4eb20be90

README.chromium

 Name: libyuv
 URL: http://code.google.com/p/libyuv/
-Version: 711
+Version: 712
 License: BSD
 License File: LICENSE
 

include/libyuv/version.h

@@ -11,6 +11,6 @@
 #ifndef INCLUDE_LIBYUV_VERSION_H_  // NOLINT
 #define INCLUDE_LIBYUV_VERSION_H_
 
-#define LIBYUV_VERSION 711
+#define LIBYUV_VERSION 712
 
 #endif  // INCLUDE_LIBYUV_VERSION_H_  NOLINT

source/convert_from.cc

@@ -886,7 +886,7 @@ int I420ToARGB1555(const uint8* src_y, int src_stride_y,
                           uint8* rgb_buf,
                           int width) = I422ToARGB1555Row_C;
 #if defined(HAS_I422TOARGB1555ROW_SSSE3)
-  if (TestCpuFlag(kCpuHasSSSE3) && width >= 8 && width <= kMaxStride * 4) {
+  if (TestCpuFlag(kCpuHasSSSE3) && width >= 8 && width * 4 <= kMaxStride) {
     I422ToARGB1555Row = I422ToARGB1555Row_Any_SSSE3;
     if (IS_ALIGNED(width, 8)) {
       I422ToARGB1555Row = I422ToARGB1555Row_SSSE3;
@@ -937,7 +937,7 @@ int I420ToARGB4444(const uint8* src_y, int src_stride_y,
                           uint8* rgb_buf,
                           int width) = I422ToARGB4444Row_C;
 #if defined(HAS_I422TOARGB4444ROW_SSSE3)
-  if (TestCpuFlag(kCpuHasSSSE3) && width >= 8 && width <= kMaxStride * 4) {
+  if (TestCpuFlag(kCpuHasSSSE3) && width >= 8 && width * 4 <= kMaxStride) {
     I422ToARGB4444Row = I422ToARGB4444Row_Any_SSSE3;
     if (IS_ALIGNED(width, 8)) {
       I422ToARGB4444Row = I422ToARGB4444Row_SSSE3;
@@ -989,7 +989,7 @@ int I420ToRGB565(const uint8* src_y, int src_stride_y,
 #if defined(HAS_I422TORGB565ROW_SSSE3)
   if (TestCpuFlag(kCpuHasSSSE3) && width >= 8
 #if defined(__x86_64__) || defined(__i386__)
-      && width <= kMaxStride * 4
+      && width * 4 <= kMaxStride
 #endif
       ) {
     I422ToRGB565Row = I422ToRGB565Row_Any_SSSE3;

source/format_conversion.cc

@@ -387,6 +387,9 @@ int I420ToBayer(const uint8* src_y, int src_stride_y,
                 uint8* dst_bayer, int dst_stride_bayer,
                 int width, int height,
                 uint32 dst_fourcc_bayer) {
+  if (width * 4 > kMaxStride) {
+    return -1;  // Size too large for row buffer
+  }
   // Negative height means invert the image.
   if (height < 0) {
     height = -height;

source/planar_functions.cc

@@ -939,7 +939,7 @@ int NV12ToRGB565(const uint8* src_y, int src_stride_y,
                           uint8* rgb_buf,
                           int width) = NV12ToRGB565Row_C;
 #if defined(HAS_NV12TORGB565ROW_SSSE3)
-  if (TestCpuFlag(kCpuHasSSSE3) && width >= 8 && width <= kMaxStride * 4) {
+  if (TestCpuFlag(kCpuHasSSSE3) && width >= 8 && width * 4 <= kMaxStride) {
     NV12ToRGB565Row = NV12ToRGB565Row_Any_SSSE3;
     if (IS_ALIGNED(width, 8)) {
       NV12ToRGB565Row = NV12ToRGB565Row_SSSE3;
@@ -986,7 +986,7 @@ int NV21ToRGB565(const uint8* src_y, int src_stride_y,
                           uint8* rgb_buf,
                           int width) = NV21ToRGB565Row_C;
 #if defined(HAS_NV21TORGB565ROW_SSSE3)
-  if (TestCpuFlag(kCpuHasSSSE3) && width >= 8 && width <= kMaxStride * 4) {
+  if (TestCpuFlag(kCpuHasSSSE3) && width >= 8 && width * 4 <= kMaxStride) {
     NV21ToRGB565Row = NV21ToRGB565Row_Any_SSSE3;
     if (IS_ALIGNED(width, 8)) {
       NV21ToRGB565Row = NV21ToRGB565Row_SSSE3;

source/rotate_argb.cc

@@ -138,9 +138,8 @@ void ARGBRotate180(const uint8* src, int src_stride,
     CopyRow = CopyRow_MIPS;
   }
 #endif
-  if (width * 4 > kMaxStride) {
-    return;
-  }
+  bool direct = width * 4 > kMaxStride;
+
   // Swap first and last row and mirror the content. Uses a temporary row.
   SIMD_ALIGNED(uint8 row[kMaxStride]);
   const uint8* src_bot = src + src_stride * (height - 1);
@@ -148,11 +147,18 @@ void ARGBRotate180(const uint8* src, int src_stride,
   int half_height = (height + 1) >> 1;
   // Odd height will harmlessly mirror the middle row twice.
   for (int y = 0; y < half_height; ++y) {
-    ARGBMirrorRow(src, row, width);  // Mirror first row into a buffer
+    if (direct) {
+      ARGBMirrorRow(src, dst_bot, width);  // Mirror first row into a buffer
+      if (src != src_bot) {
+        ARGBMirrorRow(src_bot, dst, width);  // Mirror last row into first row
+      }
+    } else {
+      ARGBMirrorRow(src, row, width);  // Mirror first row into a buffer
+      ARGBMirrorRow(src_bot, dst, width);  // Mirror last row into first row
+      CopyRow(row, dst_bot, width * 4);  // Copy first mirrored row into last
+    }
     src += src_stride;
-    ARGBMirrorRow(src_bot, dst, width);  // Mirror last row into first row
     dst += dst_stride;
-    CopyRow(row, dst_bot, width * 4);  // Copy first mirrored row into last
     src_bot -= src_stride;
     dst_bot -= dst_stride;
   }

source/scale.cc

@@ -2299,7 +2299,8 @@ int I420Scale(const uint8* src_y, int src_stride_y,
               int dst_width, int dst_height,
               FilterMode filtering) {
   if (!src_y || !src_u || !src_v || src_width == 0 || src_height == 0 ||
-      !dst_y || !dst_u || !dst_v || dst_width <= 0 || dst_height <= 0) {
+      !dst_y || !dst_u || !dst_v || dst_width <= 0 || dst_height <= 0 ||
+      src_width > 32767 || src_height > 32767) {
     return -1;
   }
   // Negative height means invert the image.
@@ -2362,7 +2363,8 @@ int Scale(const uint8* src_y, const uint8* src_u, const uint8* src_v,
           int dst_width, int dst_height,
           bool interpolate) {
   if (!src_y || !src_u || !src_v || src_width <= 0 || src_height == 0 ||
-      !dst_y || !dst_u || !dst_v || dst_width <= 0 || dst_height <= 0) {
+      !dst_y || !dst_u || !dst_v || dst_width <= 0 || dst_height <= 0 ||
+      src_width > 32767 || src_height > 32767) {
     return -1;
   }
   // Negative height means invert the image.
@@ -2423,6 +2425,7 @@ int ScaleOffset(const uint8* src, int src_width, int src_height,
                 bool interpolate) {
   if (!src || src_width <= 0 || src_height <= 0 ||
       !dst || dst_width <= 0 || dst_height <= 0 || dst_yoffset < 0 ||
+      src_width > 32767 || src_height > 32767 ||
       dst_yoffset >= dst_height) {
     return -1;
   }

source/scale_argb.cc

@@ -1163,6 +1163,7 @@ int ARGBScaleClip(const uint8* src_argb, int src_stride_argb,
   if (!src_argb || src_width == 0 || src_height == 0 ||
       !dst_argb || dst_width <= 0 || dst_height <= 0 ||
       clip_x < 0 || clip_y < 0 ||
+      src_width > 32767 || src_height > 32767 ||
       (clip_x + clip_width) > dst_width ||
       (clip_y + clip_height) > dst_height) {
     return -1;
@@ -1181,7 +1182,8 @@ int ARGBScale(const uint8* src_argb, int src_stride_argb,
               int dst_width, int dst_height,
               FilterMode filtering) {
   if (!src_argb || src_width == 0 || src_height == 0 ||
-      !dst_argb || dst_width <= 0 || dst_height <= 0) {
+      !dst_argb || dst_width <= 0 || dst_height <= 0 ||
+      src_width > 32767 || src_height > 32767) {
     return -1;
   }
   ScaleARGB(src_argb, src_stride_argb, src_width, src_height,