coffee/libyuv
1
0
Fork 0
mirror of https://chromium.googlesource.com/libyuv/libyuv synced 2026-06-15 00:16:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix int negation overflow in ConvertToARGB/I420

Browse Source 
Fix int negation overflow in ConvertToARGB() and ConvertToI420().

Change-Id: Ia8e1f1a2994962a0372f4c31f6cc9c8972d8a954
Reviewed-on: https://chromium-review.googlesource.com/c/libyuv/libyuv/+/7904588
Reviewed-by: James Zern <jzern@google.com>
Commit-Queue: Wan-Teh Chang <wtc@google.com>
This commit is contained in:
Wan-Teh Chang 2026-06-05 11:39:31 -07:00 committed by libyuv-scoped@luci-project-accounts.iam.gserviceaccount.com
parent f722313c74
commit ccd415101d
2 changed files with 22 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
source/convert_to_argb.cc
View File

@ -50,6 +50,13 @@ int ConvertToARGB(const uint8_t* sample,
int crop_height,
enum RotationMode rotation,
uint32_t fourcc) {
if (dst_argb == NULL || sample == NULL || src_width <= 0 ||
src_width > INT_MAX / 4 || crop_width <= 0 || crop_width > INT_MAX / 4 ||
src_height == 0 || src_height == INT_MIN || crop_height == 0 ||
crop_height == INT_MIN) {
return -1;
}
uint32_t format = CanonicalFourCC(fourcc);
int aligned_src_width = (src_width + 1) & ~1;
const uint8_t* src;
@ -70,12 +77,6 @@ int ConvertToARGB(const uint8_t* sample,
uint8_t* rotate_buffer = NULL;
int abs_crop_height = (crop_height < 0) ? -crop_height : crop_height;
if (dst_argb == NULL || sample == NULL || src_width <= 0 ||
src_width > INT_MAX / 4 || crop_width <= 0 || crop_width > INT_MAX / 4 ||
src_height == 0 || src_height == INT_MIN || crop_height == 0 ||
crop_height == INT_MIN) {
return -1;
}
if (src_height < 0) {
inv_crop_height = -inv_crop_height;
}

27
source/convert_to_i420.cc
View File

@ -44,11 +44,24 @@ int ConvertToI420(const uint8_t* sample,
int crop_height,
enum RotationMode rotation,
uint32_t fourcc) {
if (src_height == INT_MIN || crop_height == INT_MIN) {
return -1;
}
const int abs_src_height = (src_height < 0) ? -src_height : src_height;
const int abs_crop_height = (crop_height < 0) ? -crop_height : crop_height;
if (!dst_y || !dst_u || !dst_v || !sample || src_width <= 0 ||
src_width > INT_MAX / 4 || crop_width <= 0 || src_height == 0 ||
crop_height == 0 || crop_x < 0 || crop_y < 0 || crop_width > src_width ||
crop_x > src_width - crop_width || abs_crop_height > abs_src_height ||
crop_y > abs_src_height - abs_crop_height) {
return -1;
}
uint32_t format = CanonicalFourCC(fourcc);
const uint8_t* src;
const uint8_t* src_uv;
const int abs_src_height = (src_height < 0) ? -src_height : src_height;
const int abs_crop_height = (crop_height < 0) ? -crop_height : crop_height;
int r = 0;
LIBYUV_BOOL need_buf =
(rotation && format != FOURCC_I420 && format != FOURCC_NV12 &&
@ -63,16 +76,6 @@ int ConvertToI420(const uint8_t* sample,
uint8_t* rotate_buffer = NULL;
const int inv_crop_height =
(src_height < 0) ? -abs_crop_height : abs_crop_height;
if (!dst_y || !dst_u || !dst_v || !sample || src_width <= 0 ||
src_width > INT_MAX / 4 || crop_width <= 0 || src_height == 0 ||
src_height == INT_MIN || crop_height == 0 || crop_height == INT_MIN ||
crop_x < 0 || crop_y < 0 || crop_width > src_width ||
crop_x > src_width - crop_width || abs_crop_height > abs_src_height ||
crop_y > abs_src_height - abs_crop_height) {
return -1;
}
int aligned_src_width = (src_width + 1) & ~1;
// One pass rotation is available for some formats. For the rest, convert