coffee/libyuv
1
0
Fork 0
mirror of https://chromium.googlesource.com/libyuv/libyuv synced 2026-06-15 08:26:06 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix int negation overflow in ConvertToARGB/I420

Browse Source 
Fix int negation overflow in ConvertToARGB() and ConvertToI420().

Change-Id: Ia8e1f1a2994962a0372f4c31f6cc9c8972d8a954
This commit is contained in:
Wan-Teh Chang 2026-06-05 11:15:47 -07:00
parent f722313c74
commit ee3b6b7d17
2 changed files with 13 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
source/convert_to_argb.cc
View File

@ -50,6 +50,12 @@ int ConvertToARGB(const uint8_t* sample,
int crop_height, int crop_height,
enum RotationMode rotation, enum RotationMode rotation,
uint32_t fourcc) { uint32_t fourcc) {
if (dst_argb == NULL || sample == NULL || src_width <= 0 ||
src_width > INT_MAX / 4 || crop_width <= 0 || crop_width > INT_MAX / 4 ||
src_height == 0 || src_height == INT_MIN || crop_height == 0 ||
crop_height == INT_MIN) {
return -1;
}
uint32_t format = CanonicalFourCC(fourcc); uint32_t format = CanonicalFourCC(fourcc);
int aligned_src_width = (src_width + 1) & ~1; int aligned_src_width = (src_width + 1) & ~1;
const uint8_t* src; const uint8_t* src;
@ -69,13 +75,6 @@ int ConvertToARGB(const uint8_t* sample,
int dest_dst_stride_argb = dst_stride_argb; int dest_dst_stride_argb = dst_stride_argb;
uint8_t* rotate_buffer = NULL; uint8_t* rotate_buffer = NULL;
int abs_crop_height = (crop_height < 0) ? -crop_height : crop_height; int abs_crop_height = (crop_height < 0) ? -crop_height : crop_height;
if (dst_argb == NULL || sample == NULL || src_width <= 0 ||
src_width > INT_MAX / 4 || crop_width <= 0 || crop_width > INT_MAX / 4 ||
src_height == 0 || src_height == INT_MIN || crop_height == 0 ||
crop_height == INT_MIN) {
return -1;
}
if (src_height < 0) { if (src_height < 0) {
inv_crop_height = -inv_crop_height; inv_crop_height = -inv_crop_height;
} }

12
source/convert_to_i420.cc
View File

@ -44,6 +44,12 @@ int ConvertToI420(const uint8_t* sample,
int crop_height, int crop_height,
enum RotationMode rotation, enum RotationMode rotation,
uint32_t fourcc) { uint32_t fourcc) {
if (!dst_y || !dst_u || !dst_v || !sample || src_width <= 0 ||
src_width > INT_MAX / 4 || crop_width <= 0 || src_height == 0 ||
src_height == INT_MIN || crop_height == 0 || crop_height == INT_MIN ||
crop_x < 0 || crop_y < 0 || crop_width > src_width) {
return -1;
}
uint32_t format = CanonicalFourCC(fourcc); uint32_t format = CanonicalFourCC(fourcc);
const uint8_t* src; const uint8_t* src;
const uint8_t* src_uv; const uint8_t* src_uv;
@ -64,11 +70,7 @@ int ConvertToI420(const uint8_t* sample,
const int inv_crop_height = const int inv_crop_height =
(src_height < 0) ? -abs_crop_height : abs_crop_height; (src_height < 0) ? -abs_crop_height : abs_crop_height;
if (!dst_y || !dst_u || !dst_v || !sample || src_width <= 0 || if (crop_x > src_width - crop_width || abs_crop_height > abs_src_height ||
src_width > INT_MAX / 4 || crop_width <= 0 || src_height == 0 ||
src_height == INT_MIN || crop_height == 0 || crop_height == INT_MIN ||
crop_x < 0 || crop_y < 0 || crop_width > src_width ||
crop_x > src_width - crop_width || abs_crop_height > abs_src_height ||
crop_y > abs_src_height - abs_crop_height) { crop_y > abs_src_height - abs_crop_height) {
return -1; return -1;
} }