From 553f01170b72a841aa0aff61acfb1727d635be9c Mon Sep 17 00:00:00 2001 From: Wan-Teh Chang Date: Tue, 18 Aug 2026 09:30:06 -0700 Subject: [PATCH] Check rotate_any.cc and scale_any.cc for overflows Inspect all the ANY macros. Change-Id: Icdf382181572b34490e0830d1a0a14286b84faaf Reviewed-on: https://chromium-review.googlesource.com/c/libyuv/libyuv/+/8266561 Reviewed-by: Frank Barchard Commit-Queue: Wan-Teh Chang --- source/rotate_any.cc | 25 ++++++++++++++----------- source/scale_any.cc | 36 ++++++++++++++++++++++++------------ 2 files changed, 38 insertions(+), 23 deletions(-) diff --git a/source/rotate_any.cc b/source/rotate_any.cc index bf62c067b..791494559 100644 --- a/source/rotate_any.cc +++ b/source/rotate_any.cc @@ -18,15 +18,16 @@ namespace libyuv { extern "C" { #endif -#define TANY(NAMEANY, TPOS_SIMD, TPOS_C, MASK) \ - void NAMEANY(const uint8_t* src, int src_stride, uint8_t* dst, \ - int dst_stride, int width) { \ - int r = width & MASK; \ - int n = width - r; \ - if (n > 0) { \ - TPOS_SIMD(src, src_stride, dst, dst_stride, n); \ - } \ - TPOS_C(src + n, src_stride, dst + n * dst_stride, dst_stride, r); \ +#define TANY(NAMEANY, TPOS_SIMD, TPOS_C, MASK) \ + void NAMEANY(const uint8_t* src, int src_stride, uint8_t* dst, \ + int dst_stride, int width) { \ + int r = width & MASK; \ + int n = width - r; \ + if (n > 0) { \ + TPOS_SIMD(src, src_stride, dst, dst_stride, n); \ + } \ + ptrdiff_t np = n; \ + TPOS_C(src + np, src_stride, dst + np * dst_stride, dst_stride, r); \ } #ifdef HAS_TRANSPOSEWX8_NEON @@ -55,8 +56,10 @@ TANY(TransposeWx16_Any_LSX, TransposeWx16_LSX, TransposeWx16_C, 15) if (n > 0) { \ TPOS_SIMD(src, src_stride, dst_a, dst_stride_a, dst_b, dst_stride_b, n); \ } \ - TransposeUVWx8_C(src + n * 2, src_stride, dst_a + n * dst_stride_a, \ - dst_stride_a, dst_b + n * dst_stride_b, dst_stride_b, r); \ + ptrdiff_t np = n; \ + TransposeUVWx8_C(src + np * 2, src_stride, dst_a + np * dst_stride_a, \ + dst_stride_a, dst_b + np * dst_stride_b, dst_stride_b, \ + r); \ } #ifdef HAS_TRANSPOSEUVWX8_NEON diff --git a/source/scale_any.cc b/source/scale_any.cc index 4fa7eac3b..c93b3f084 100644 --- a/source/scale_any.cc +++ b/source/scale_any.cc @@ -8,6 +8,7 @@ * be found in the AUTHORS file in the root of the source tree. */ +#include #include // For memset/memcpy #include "libyuv/scale.h" @@ -30,8 +31,9 @@ extern "C" { if (n > 0) { \ SCALEROWDOWN_SIMD(src_ptr, src_stride, dst_ptr, n); \ } \ - SCALEROWDOWN_C(src_ptr + (n * FACTOR) * BPP, src_stride, \ - dst_ptr + n * BPP, r); \ + ptrdiff_t np = n; \ + SCALEROWDOWN_C(src_ptr + (np * FACTOR) * BPP, src_stride, \ + dst_ptr + np * BPP, r); \ } // Fixed scale down for odd source width. Used by I420Blend subsampling. @@ -45,8 +47,9 @@ extern "C" { if (n > 0) { \ SCALEROWDOWN_SIMD(src_ptr, src_stride, dst_ptr, n); \ } \ - SCALEROWDOWN_C(src_ptr + (n * FACTOR) * BPP, src_stride, \ - dst_ptr + n * BPP, r + 1); \ + ptrdiff_t np = n; \ + SCALEROWDOWN_C(src_ptr + (np * FACTOR) * BPP, src_stride, \ + dst_ptr + np * BPP, r + 1); \ } #ifdef HAS_SCALEROWDOWN2_SSSE3 @@ -416,8 +419,9 @@ SDANY(ScaleARGBRowDown2Box_Any_LSX, if (n > 0) { \ SCALEROWDOWN_SIMD(src_ptr, src_stride, src_stepx, dst_ptr, n); \ } \ - SCALEROWDOWN_C(src_ptr + (n * src_stepx) * BPP, src_stride, src_stepx, \ - dst_ptr + n * BPP, r); \ + ptrdiff_t np = n; \ + SCALEROWDOWN_C(src_ptr + (np * src_stepx) * BPP, src_stride, src_stepx, \ + dst_ptr + np * BPP, r); \ } #ifdef HAS_SCALEARGBROWDOWNEVEN_SSE2 @@ -471,17 +475,22 @@ SDAANY(ScaleUVRowDownEven_Any_NEON, #define SAROW(NAMEANY, ANY_SIMD, SBPP, BPP, MASK) \ void NAMEANY(const uint8_t* src_ptr, uint16_t* dst_ptr, int width) { \ SIMD_ALIGNED(uint8_t src_temp[32]); \ + static_assert((MASK + 1) * SBPP <= sizeof(src_temp), \ + "src_temp buffer too small"); \ SIMD_ALIGNED(uint16_t dst_temp[32]); \ + static_assert((MASK + 1) * BPP <= sizeof(dst_temp), \ + "dst_temp buffer too small"); \ memset(src_temp, 0, sizeof(src_temp)); /* for msan */ \ int r = width & MASK; \ int n = width & ~MASK; \ if (n > 0) { \ ANY_SIMD(src_ptr, dst_ptr, n); \ } \ - memcpy(src_temp, src_ptr + n * SBPP, r * SBPP); \ - memcpy(dst_temp, dst_ptr + n * BPP, r * BPP); \ + ptrdiff_t np = n; \ + memcpy(src_temp, src_ptr + np * SBPP, r * SBPP); \ + memcpy(dst_temp, dst_ptr + np * BPP, r * BPP); \ ANY_SIMD(src_temp, dst_temp, MASK + 1); \ - memcpy(dst_ptr + n * BPP, dst_temp, r * BPP); \ + memcpy(dst_ptr + np * BPP, dst_temp, r * BPP); \ } #ifdef HAS_SCALEADDROW_SSE2 @@ -535,7 +544,8 @@ SAANY(ScaleAddRow_Any_LSX, ScaleAddRow_LSX, ScaleAddRow_C, 15) if (n > 0) { \ TERP_SIMD(dst_ptr, src_ptr, n, x, dx); \ } \ - TERP_C(dst_ptr + n * BPP, src_ptr, r, x + n * dx, dx); \ + ptrdiff_t np = n; \ + TERP_C(dst_ptr + np * BPP, src_ptr, r, x + np * dx, dx); \ } #ifdef HAS_SCALEFILTERCOLS_NEON @@ -819,7 +829,8 @@ SU2BLANY(ScaleRowUp2_Bilinear_16_Any_NEON, if (n != 0) { \ SIMD(src_ptr, dst_ptr + 2, n); \ } \ - C(src_ptr + n, dst_ptr + 2 * n + 2, r); \ + ptrdiff_t np = n; \ + C(src_ptr + np, dst_ptr + 2 * np + 2, r); \ } \ dst_ptr[2 * dst_width - 2] = src_ptr[((dst_width + 1) & ~1) - 2]; \ dst_ptr[2 * dst_width - 1] = src_ptr[((dst_width + 1) & ~1) - 1]; \ @@ -907,7 +918,8 @@ SBUH2LANY(ScaleUVRowUp2_Linear_16_Any_NEON, if (n != 0) { \ SIMD(sa, sb - sa, da + 2, db - da, n); \ } \ - C(sa + n, sb - sa, da + 2 * n + 2, db - da, r); \ + ptrdiff_t np = n; \ + C(sa + np, sb - sa, da + 2 * np + 2, db - da, r); \ } \ da[2 * dst_width - 2] = (3 * sa[((dst_width + 1) & ~1) - 2] + \ sb[((dst_width + 1) & ~1) - 2] + 2) >> \