Update CopyPlane to handle 0 width and height dimensions

If a width, height, and src/dst strides passed in are all 0, height is updated to 1 which means some CPU optimized functions may try to copy data when the dst rect is not valid.

Bug: b:234340482
Change-Id: I63be1c6ba05d669d67f5079d812acbec09c8f6c9
Reviewed-on: https://chromium-review.googlesource.com/c/libyuv/libyuv/+/3689909
Reviewed-by: Frank Barchard <fbarchard@chromium.org>
This commit is contained in:
Joe Downing 2022-06-06 17:50:23 +00:00 committed by Frank Barchard
parent f8a1ee3314
commit c0c8c40b31
2 changed files with 38 additions and 0 deletions

View File

@ -35,6 +35,9 @@ void CopyPlane(const uint8_t* src_y,
int height) {
int y;
void (*CopyRow)(const uint8_t* src, uint8_t* dst, int width) = CopyRow_C;
if (width == 0 || height == 0) {
return;
}
// Negative height means invert the image.
if (height < 0) {
height = -height;

View File

@ -1484,6 +1484,41 @@ TEST_F(LibYUVPlanarTest, TestCopyPlane) {
EXPECT_EQ(0, err);
}
TEST_F(LibYUVPlanarTest, TestCopyPlaneZeroDimensionRegressionTest) {
// Regression test to verify copying a rect with a zero height or width does
// not lead to memory corruption.
uint8_t src = 42;
uint8_t dst = 0;
// Disable all optimizations.
MaskCpuFlags(disable_cpu_flags_);
CopyPlane(&src, 0, &dst, 0, 0, 0);
EXPECT_EQ(src, 42);
EXPECT_EQ(dst, 0);
CopyPlane(&src, 1, &dst, 1, 1, 0);
EXPECT_EQ(src, 42);
EXPECT_EQ(dst, 0);
CopyPlane(&src, 1, &dst, 1, 0, 1);
EXPECT_EQ(src, 42);
EXPECT_EQ(dst, 0);
// Enable optimizations.
MaskCpuFlags(benchmark_cpu_info_);
CopyPlane(&src, 0, &dst, 0, 0, 0);
EXPECT_EQ(src, 42);
EXPECT_EQ(dst, 0);
CopyPlane(&src, 1, &dst, 1, 1, 0);
EXPECT_EQ(src, 42);
EXPECT_EQ(dst, 0);
CopyPlane(&src, 1, &dst, 1, 0, 1);
EXPECT_EQ(src, 42);
EXPECT_EQ(dst, 0);
}
TEST_F(LibYUVPlanarTest, TestDetilePlane) {
int i, j;