Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e155ba5e authored by Songyue Han's avatar Songyue Han Committed by Automerger Merge Worker
Browse files

Merge "Fix a couple of OOB read bugs found by the fuzzer." into tm-qpr-dev am: 55a1d27a 

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/av/+/22259827



Change-Id: Ia525e57c7add3601627513fe11205aa0e67d9bcb
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents c29cee7d 55a1d27a

media/libstagefright/colorconversion/ColorConverter.cpp

+33 −35
Original line number Diff line number Diff line
@@ -340,6 +340,14 @@ size_t ColorConverter::BitmapParams::cropHeight() const { 
    return mCropBottom - mCropTop + 1;

}



bool ColorConverter::BitmapParams::isValid() const {

    if (!((mStride & 1) == 0  // stride must be even

        && mStride >= mBpp * cropWidth())) {

            return false;

    }

    return true;

}



status_t ColorConverter::convert(

        const void *srcBits,

        size_t srcWidth, size_t srcHeight, size_t srcStride,
@@ -359,7 +367,9 @@ status_t ColorConverter::convert( 
            dstWidth, dstHeight, dstStride,

            dstCropLeft, dstCropTop, dstCropRight, dstCropBottom, mDstFormat);



    if (!((src.mCropLeft & 1) == 0

    if (!(src.isValid()

            && dst.isValid()

            && (src.mCropLeft & 1) == 0

            && src.cropWidth() == dst.cropWidth()

            && src.cropHeight() == dst.cropHeight())) {

        return ERROR_UNSUPPORTED;
@@ -463,6 +473,7 @@ const struct ColorConverter::Coeffs *ColorConverter::getMatrix() const { 
    }

}



// Interleaved YUV 422 CbYCrY to RGB565

status_t ColorConverter::convertCbYCrY(

        const BitmapParams &src, const BitmapParams &dst) {

    // XXX Untested
@@ -485,10 +496,10 @@ status_t ColorConverter::convertCbYCrY( 
        + dst.mCropTop * dst.mWidth + dst.mCropLeft;



    const uint8_t *src_ptr = (const uint8_t *)src.mBits

        + (src.mCropTop * dst.mWidth + src.mCropLeft) * 2;

        + (src.mCropTop * src.mWidth + src.mCropLeft) * 2;



    for (size_t y = 0; y < src.cropHeight(); ++y) {

        for (size_t x = 0; x < src.cropWidth(); x += 2) {

        for (size_t x = 0; x < src.cropWidth() - 1; x += 2) {

            signed y1 = (signed)src_ptr[2 * x + 1] - _c16;

            signed y2 = (signed)src_ptr[2 * x + 3] - _c16;

            signed u = (signed)src_ptr[2 * x] - 128;
@@ -658,13 +669,15 @@ getReadFromSrc(OMX_COLOR_FORMATTYPE srcFormat) { 
            *u = ((uint8_t*)src_u)[x / 2] - 128;

            *v = ((uint8_t*)src_v)[x / 2] - 128;

        };

    // this format stores 10 bits content with 16 bits

    // converting it to 8 bits src

    case OMX_COLOR_FormatYUV420Planar16:

        return [](void *src_y, void *src_u, void *src_v, size_t x,

                signed *y1, signed *y2, signed *u, signed *v) {

            *y1 = (signed)(((uint16_t*)src_y)[x] >> 2);

            *y2 = (signed)(((uint16_t*)src_y)[x + 1] >> 2);

            *u = (signed)(((uint16_t*)src_u)[x / 2] >> 2) - 128;

            *v = (signed)(((uint16_t*)src_v)[x / 2] >> 2) - 128;

            *y1 = (uint8_t)(((uint16_t*)src_y)[x] >> 2);

            *y2 = (uint8_t)(((uint16_t*)src_y)[x + 1] >> 2);

            *u = (uint8_t)(((uint16_t*)src_u)[x / 2] >> 2) - 128;

            *v = (uint8_t)(((uint16_t*)src_v)[x / 2] >> 2) - 128;

        };

    default:

        TRESPASS();
@@ -1122,46 +1135,25 @@ status_t ColorConverter::convertYUV420Planar16ToY410( 


status_t ColorConverter::convertQCOMYUV420SemiPlanar(

        const BitmapParams &src, const BitmapParams &dst) {

    const uint8_t *src_y =

        (const uint8_t *)src.mBits + src.mCropTop * src.mWidth + src.mCropLeft;



    const uint8_t *src_u =

        (const uint8_t *)src_y + src.mWidth * src.mHeight

        + src.mCropTop * src.mWidth + src.mCropLeft;



    /* QCOMYUV420SemiPlanar is NV21, while MediaCodec uses NV12 */

    return convertYUV420SemiPlanarBase(

            src, dst, src_y, src_u, src.mWidth /* row_inc */, true /* isNV21 */);

            src, dst, src.mWidth /* row_inc */, true /* isNV21 */);

}



status_t ColorConverter::convertTIYUV420PackedSemiPlanar(

        const BitmapParams &src, const BitmapParams &dst) {

    const uint8_t *src_y =

        (const uint8_t *)src.mBits + src.mCropTop * src.mWidth + src.mCropLeft;



    const uint8_t *src_u =

        (const uint8_t *)src_y + src.mWidth * (src.mHeight - src.mCropTop / 2);



    return convertYUV420SemiPlanarBase(

            src, dst, src_y, src_u, src.mWidth /* row_inc */);

            src, dst, src.mWidth /* row_inc */);

}



status_t ColorConverter::convertYUV420SemiPlanar(

        const BitmapParams &src, const BitmapParams &dst) {

    const uint8_t *src_y =

        (const uint8_t *)src.mBits + src.mCropTop * src.mStride + src.mCropLeft;



    const uint8_t *src_u =

        (const uint8_t *)src.mBits + src.mHeight * src.mStride +

        (src.mCropTop / 2) * src.mStride + src.mCropLeft;



    return convertYUV420SemiPlanarBase(

            src, dst, src_y, src_u, src.mStride /* row_inc */);

            src, dst, src.mStride /* row_inc */);

}



status_t ColorConverter::convertYUV420SemiPlanarBase(

        const BitmapParams &src, const BitmapParams &dst,

        const uint8_t *src_y, const uint8_t *src_u, size_t row_inc, bool isNV21) {

status_t ColorConverter::convertYUV420SemiPlanarBase(const BitmapParams &src,

        const BitmapParams &dst, size_t row_inc, bool isNV21) {

    const struct Coeffs *matrix = getMatrix();

    if (!matrix) {

        return ERROR_UNSUPPORTED;
@@ -1179,6 +1171,12 @@ status_t ColorConverter::convertYUV420SemiPlanarBase( 
    uint16_t *dst_ptr = (uint16_t *)((uint8_t *)

            dst.mBits + dst.mCropTop * dst.mStride + dst.mCropLeft * dst.mBpp);



    const uint8_t *src_y =

        (const uint8_t *)src.mBits + src.mCropTop * row_inc + src.mCropLeft;



    const uint8_t *src_u = (const uint8_t *)src.mBits + src.mHeight * row_inc +

        (src.mCropTop / 2) * row_inc + src.mCropLeft;



    for (size_t y = 0; y < src.cropHeight(); ++y) {

        for (size_t x = 0; x < src.cropWidth(); x += 2) {

            signed y1 = (signed)src_y[x] - _c16;

media/libstagefright/include/media/stagefright/ColorConverter.h

+3 −1
Original line number Diff line number Diff line
@@ -74,6 +74,8 @@ private: 
        size_t cropWidth() const;

        size_t cropHeight() const;



        bool isValid() const;



        void *mBits;

        OMX_COLOR_FORMATTYPE mColorFormat;

        size_t mWidth, mHeight;
@@ -121,7 +123,7 @@ private: 


    status_t convertYUV420SemiPlanarBase(

            const BitmapParams &src, const BitmapParams &dst,

            const uint8_t *src_y, const uint8_t *src_u, size_t row_inc, bool isNV21 = false);

            size_t row_inc, bool isNV21 = false);



    status_t convertTIYUV420PackedSemiPlanar(

            const BitmapParams &src, const BitmapParams &dst);