6 Commits

Author SHA1 Message Date
Gerrit User 5245127
46ed1d3aab Update patch set 2
Patch Set 2:

Yes, there is a real bug. All dimension arithmetic in the scaler is 32-bit int, so in your example the frame-size computation (2e9 rows x 16 x 4 = 128e9 bytes) overflows int - the destination buffer ends up undersized while ScalePlaneVertical writes dst_height rows. I reproduced a heap-buffer-overflow WRITE under ASan: ScalePlane(s,16, 16,16, d,16, 16,INT_MAX, kFilterNone) -> InterpolateRow_Any_AVX2 (row_any.cc:1882). Also a signed-integer overflow: dst_width=INT_MAX -> (dst_width+1) at scale.cc:2186 -> wild scaling -> SEGV. That is why the cap cannot sit near INT_MAX - INT_MAX x stride still overflows. 32768 keeps every downstream 32-bit computation in range, matching the existing source-side convention.

Patch-set: 2
2026-10-19 05:30:46 -07:00
Gerrit User 5245127
3fadb61f19 Update patch set 2
Patch Set 2:

test ping, please ignore

Patch-set: 2
Attention: {"person_ident":"Gerrit User 5245127 \u003c5245127@3ce6091f-6c88-37e8-8c75-72f92ae8dfba\u003e","operation":"REMOVE","reason":"removed on reply"}
2026-10-19 05:28:09 -07:00
Gerrit User 1115898
d072172291 Update patch set 1
Patch Set 1:

(1 comment)

Patch-set: 1
2026-10-19 05:23:37 -07:00
Gerrit User 5245127
97de4570a7 Create patch set 2
Patch Set 2: Patch Set 1 was rebased

Patch-set: 2
Patch-set-description: Rebase
Subject: Cap destination dimensions at 32768 in scaler entry points
Commit: cd49e5f70346fef7d15381e92a7173a098867eda
Tag: autogenerated:gerrit:newPatchSet
Groups: e4ba7c3a0b77736e94fd23987fe68a17761da041
Base: ec29aca502fa3611fd4691ebd25130846f3cee2a
Ours: e4ba7c3a0b77736e94fd23987fe68a17761da041
Theirs: 2404f9730e2e48946d29c6d28e3b630302a8d842
Merge-Strategy: recursive
Contains-Conflicts: false
2026-10-19 05:23:36 -07:00
Gerrit User 1115898
013fabcd80 Update patch set 1
Patch Set 1:

(1 comment)

Patch-set: 1
CC: Gerrit User 1115898 <1115898@3ce6091f-6c88-37e8-8c75-72f92ae8dfba>
Attention: {"person_ident":"Gerrit User 5245127 \u003c5245127@3ce6091f-6c88-37e8-8c75-72f92ae8dfba\u003e","operation":"ADD","reason":"\u003cGERRIT_ACCOUNT_1115898\u003e replied on the change"}
2026-10-19 05:17:24 -07:00
Gerrit User 5245127
0f4e19e025 Create change
Uploaded patch set 1.

Patch-set: 1
Change-id: Iacdbb98868b5255902b2fe36e77bf72baf7b1b42
Subject: Cap destination dimensions at 32768 in scaler entry points
Branch: refs/heads/main
Status: new
Topic: 
Commit: e4ba7c3a0b77736e94fd23987fe68a17761da041
Tag: autogenerated:gerrit:newPatchSet
Groups: e4ba7c3a0b77736e94fd23987fe68a17761da041
Private: false
Work-in-progress: false
2026-10-17 03:24:01 -07:00