From 46ed1d3aabccaaa2167f1ff1f5e2cb72b606efd0 Mon Sep 17 00:00:00 2001
From: Gerrit User 5245127 <5245127@3ce6091f-6c88-37e8-8c75-72f92ae8dfba>
Date: Mon, 19 Oct 2026 05:30:46 -0700
Subject: [PATCH] Update patch set 2

Patch Set 2:

Yes, there is a real bug. All dimension arithmetic in the scaler is 32-bit int, so in your example the frame-size computation (2e9 rows x 16 x 4 = 128e9 bytes) overflows int - the destination buffer ends up undersized while ScalePlaneVertical writes dst_height rows. I reproduced a heap-buffer-overflow WRITE under ASan: ScalePlane(s,16, 16,16, d,16, 16,INT_MAX, kFilterNone) -> InterpolateRow_Any_AVX2 (row_any.cc:1882). Also a signed-integer overflow: dst_width=INT_MAX -> (dst_width+1) at scale.cc:2186 -> wild scaling -> SEGV. That is why the cap cannot sit near INT_MAX - INT_MAX x stride still overflows. 32768 keeps every downstream 32-bit computation in range, matching the existing source-side convention.

Patch-set: 2