| commit | 0f1527e3105e519543345888576722f2862bec73 | [log] [tgz] |
|---|---|---|
| author | Songyue Han <songyueh@google.com> | Tue Oct 03 22:40:14 2023 +0000 |
| committer | jenkins-agent <jenkins-agent> | Wed Dec 20 11:25:26 2023 +0100 |
| tree | 92c4c00384dbe18e1538a06512b5f90a0316241a | |
| parent | 4255f81701bd13aa6dfe3c2f363fdd2c235dba1d [diff] |
Fix convertYUV420Planar16ToY410 overflow issue for unsupported cropwidth. Bug: 300476626 Test: color_conversion_fuzzer (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:de2ad0fad97d6d97d1e01f0e8d8309536eb268b4) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:745ab99f7343bc236b88b9d63cd7b06ab192f9e9) (cherry picked from https://googleplex-android-review.googlesource.com/q/commit:aa8298ec8eb903e1e3dd915fa24f32e1aea1f76c) Merged-In: I8631426188af3c5f9b6c1ff6a0039254c252f733 Change-Id: I8631426188af3c5f9b6c1ff6a0039254c252f733 (cherry picked from commit 11ceb2e0ff0a98b522b8681274eb80f8dc93be7d)
diff --git a/media/libstagefright/colorconversion/ColorConverter.cpp b/media/libstagefright/colorconversion/ColorConverter.cpp index 4b4f65f..6eae6c7 100644 --- a/media/libstagefright/colorconversion/ColorConverter.cpp +++ b/media/libstagefright/colorconversion/ColorConverter.cpp
@@ -949,7 +949,8 @@ uint32_t u01, v01, y01, y23, y45, y67, uv0, uv1; size_t x = 0; - for (; x < src.cropWidth() - 3; x += 4) { + // x % 4 is always 0 so x + 3 will never overflow. + for (; x + 3 < src.cropWidth(); x += 4) { u01 = *((uint32_t*)ptr_u); ptr_u += 2; v01 = *((uint32_t*)ptr_v); ptr_v += 2;