coffee/libyuv
1
0
Fork 0
mirror of https://chromium.googlesource.com/libyuv/libyuv synced 2026-10-28 18:07:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

Avoid integer overflow if src_height == +/-32768

Browse Source 
The ScalePlaneBox(), ScalePlaneBox_16(), and ScaleUVBox() functions all
contain the following expression:

  const int max_y = (src_height << 16);

where src_height is a positive int. This expression overflows if
src_height >= 32768.

Tracing the callers, we make sure ScalePlane(), ScalePlane_16(), and
UVScale() reject src_height < -32767 || src_height > 32767 as invalid
input. (These functions negate a negative src_height before calling a
function that executes expression src_height << 16.)

Although UVScale_16() do not execute the expression src_height << 16,
make the same change to UVScale_16() for consistency with UVScale().

Bug: chromium:531172025
Change-Id: Id5b10f11f46f593945cf6bf1435b6027a6629815
This commit is contained in:
Wan-Teh Chang 2026-10-07 15:02:36 -07:00
parent 1ddb18fb6b
commit 6b4a19e130
2 changed files with 13 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
source/scale.cc
View File

@ -2085,11 +2085,12 @@ int ScalePlane(const uint8_t* src,
int dst_width,
int dst_height,
enum FilterMode filtering) {
// Reject dimensions larger than 32768 (or smaller than -32768 for height).
// This prevents FixedDiv signed integer overflows that can lead to division
// by zero/overflow crashes (SIGFPE on x86) or incorrect step calculations.
// Reject width larger than 32768 and height larger than 32767 or smaller than
// -32767. This prevents FixedDiv signed integer overflows that can lead to
// division by zero/overflow crashes (SIGFPE on x86) or incorrect step
// calculations.
if (!src || src_width <= 0 || src_height == 0 || src_width > 32768 ||
src_height < -32768 || src_height > 32768 || !dst || dst_width <= 0 ||
src_height < -32767 || src_height > 32767 || !dst || dst_width <= 0 ||
dst_height <= 0) {
return -1;
}
@ -2200,11 +2201,12 @@ int ScalePlane_16(const uint16_t* src,
int dst_width,
int dst_height,
enum FilterMode filtering) {
// Reject dimensions larger than 32768 (or smaller than -32768 for height).
// This prevents FixedDiv signed integer overflows that can lead to division
// by zero/overflow crashes (SIGFPE on x86) or incorrect step calculations.
// Reject width larger than 32768 and height larger than 32767 or smaller than
// -32767. This prevents FixedDiv signed integer overflows that can lead to
// division by zero/overflow crashes (SIGFPE on x86) or incorrect step
// calculations.
if (!src || src_width <= 0 || src_height == 0 || src_width > 32768 ||
src_height < -32768 || src_height > 32768 || !dst || dst_width <= 0 ||
src_height < -32767 || src_height > 32767 || !dst || dst_width <= 0 ||
dst_height <= 0) {
return -1;
}

6
source/scale_uv.cc
View File

@ -1272,7 +1272,7 @@ int UVScale(const uint8_t* src_uv,
int dst_height,
enum FilterMode filtering) {
if (!src_uv || src_width <= 0 || src_height == 0 || src_width > 32768 ||
src_height < -32768 || src_height > 32768 || !dst_uv || dst_width <= 0 ||
src_height < -32767 || src_height > 32767 || !dst_uv || dst_width <= 0 ||
dst_height <= 0) {
return -1;
}
@ -1295,8 +1295,8 @@ int UVScale_16(const uint16_t* src_uv,
enum FilterMode filtering) {
int dy = 0;
if (!src_uv || src_width <= 0 || src_height == 0 || src_height == INT_MIN ||
src_width > 32768 || src_height > 32768 || !dst_uv || dst_width <= 0 ||
if (!src_uv || src_width <= 0 || src_height == 0 || src_width > 32768 ||
src_height < -32767 || src_height > 32767 || !dst_uv || dst_width <= 0 ||
dst_height <= 0) {
return -1;
}