From 45258a40a0c1d72bba911f61d81fd5a44d92f50d Mon Sep 17 00:00:00 2001 From: Maximilian Hils Date: Fri, 10 Jul 2026 14:11:43 +0000 Subject: [PATCH] Fix int overflow in ARGBRotate pointer math ARGBRotate90, ARGBRotate180 and ARGBRotate270 adjusted the source and destination base pointers with expressions like src_stride_argb * (height - 1) and dst_stride_argb * (width - 1) using 32-bit int multiplication. For large frames this product overflows int before it is applied as a pointer offset, yielding an out-of-bounds pointer even on 64-bit targets (in the 90/270 cases the bad base pointer is then passed to ARGBTranspose). Cast the stride to ptrdiff_t before multiplying so the arithmetic is performed in pointer width, matching the existing correct pattern at rotate.cc:164 and rotate_argb.cc:235. R=fbarchard@google.com Change-Id: Ia4fd5d813de4fb7fa72c46aee723eca65980bccc Reviewed-on: https://chromium-review.googlesource.com/c/libyuv/libyuv/+/8070980 Reviewed-by: Frank Barchard Reviewed-by: Wan-Teh Chang Commit-Queue: Max Hils --- source/rotate_argb.cc | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/source/rotate_argb.cc b/source/rotate_argb.cc index 8cfaed034..6342b0647 100644 --- a/source/rotate_argb.cc +++ b/source/rotate_argb.cc @@ -86,7 +86,7 @@ static int ARGBRotate90(const uint8_t* src_argb, // Rotate by 90 is a ARGBTranspose with the source read // from bottom to top. So set the source pointer to the end // of the buffer and flip the sign of the source stride. - src_argb += src_stride_argb * (height - 1); + src_argb += (ptrdiff_t)src_stride_argb * (height - 1); src_stride_argb = -src_stride_argb; return ARGBTranspose(src_argb, src_stride_argb, dst_argb, dst_stride_argb, width, height); @@ -101,7 +101,7 @@ static int ARGBRotate270(const uint8_t* src_argb, // Rotate by 270 is a ARGBTranspose with the destination written // from bottom to top. So set the destination pointer to the end // of the buffer and flip the sign of the destination stride. - dst_argb += dst_stride_argb * (width - 1); + dst_argb += (ptrdiff_t)dst_stride_argb * (width - 1); dst_stride_argb = -dst_stride_argb; return ARGBTranspose(src_argb, src_stride_argb, dst_argb, dst_stride_argb, width, height); @@ -114,8 +114,8 @@ static int ARGBRotate180(const uint8_t* src_argb, int width, int height) { // Swap first and last row and mirror the content. Uses a temporary row. - const uint8_t* src_bot = src_argb + src_stride_argb * (height - 1); - uint8_t* dst_bot = dst_argb + dst_stride_argb * (height - 1); + const uint8_t* src_bot = src_argb + (ptrdiff_t)src_stride_argb * (height - 1); + uint8_t* dst_bot = dst_argb + (ptrdiff_t)dst_stride_argb * (height - 1); int half_height = (height + 1) >> 1; int y; void (*ARGBMirrorRow)(const uint8_t* src_argb, uint8_t* dst_argb, int width) =