From 9e39c1f27124c0f7c7fb1b88e4012df886e13ca9 Mon Sep 17 00:00:00 2001 From: Frank Barchard Date: Mon, 1 Feb 2016 12:29:04 -0800 Subject: [PATCH] ubsan overflow fix for multiply by 0x01010101 This is an UBSan error reported by libjingle [ RUN ] WebRtcVideoFrameTest.ConvertToYUY2BufferStride [000:000] (videoframe.cc:375): Validate frame passed. format: I420 bpp: 12 size: 1280x720 bytes: 1382400 expected: 1382400 sample[0..3]: 73, 73, 73, 73 ../../chromium/src/third_party/libyuv/source/row_gcc.cc:2903:25: runtime error: signed integer overflow: 128 * 16843009 cannot be represented in type 'int' [8/614] WebRtcVideoFrameTest.ConvertToYUY2BufferStride returned/aborted with exit code 1 (32 ms) [9/614] WebRtcVideoFrameTest.ConvertToYUY2BufferInverted (29 ms) Note: Google Test filter = WebRtcVideoFrameTest.ConvertToYUY2BufferInverted The source is uint8 and the multiply is by 0x01010101 to replicate the byte to 4 bytes. Changing the constant to 0x01010101u should avoid overflow. R=harryjin@google.com TBR=harryjin@google.com BUG=libyuv:563 Review URL: https://codereview.chromium.org/1657533005 . --- README.chromium | 2 +- include/libyuv/version.h | 2 +- source/row_gcc.cc | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/README.chromium b/README.chromium index 6c9d79763..0064bc65f 100644 --- a/README.chromium +++ b/README.chromium @@ -1,6 +1,6 @@ Name: libyuv URL: http://code.google.com/p/libyuv/ -Version: 1569 +Version: 1570 License: BSD License File: LICENSE diff --git a/include/libyuv/version.h b/include/libyuv/version.h index 75b01e14f..796fc55e2 100644 --- a/include/libyuv/version.h +++ b/include/libyuv/version.h @@ -11,6 +11,6 @@ #ifndef INCLUDE_LIBYUV_VERSION_H_ // NOLINT #define INCLUDE_LIBYUV_VERSION_H_ -#define LIBYUV_VERSION 1569 +#define LIBYUV_VERSION 1570 #endif // INCLUDE_LIBYUV_VERSION_H_ NOLINT diff --git a/source/row_gcc.cc b/source/row_gcc.cc index 61fbbbd3a..1ff1dc2f6 100644 --- a/source/row_gcc.cc +++ b/source/row_gcc.cc @@ -2900,7 +2900,7 @@ void ARGBCopyYToAlphaRow_AVX2(const uint8* src, uint8* dst, int width) { #ifdef HAS_SETROW_X86 void SetRow_X86(uint8* dst, uint8 v8, int width) { size_t width_tmp = (size_t)(width >> 2); - const uint32 v32 = v8 * 0x01010101; // Duplicate byte to all bytes. + const uint32 v32 = v8 * 0x01010101u; // Duplicate byte to all bytes. asm volatile ( "rep stosl " MEMSTORESTRING(eax,0) " \n" : "+D"(dst), // %0