Commit aa5904ba authored by Dominic Symes's avatar Dominic Symes Committed by Yaowu Xu

film-grain: fix buffer overflow

When bit_depth is 8 the copy_rect function was setting the size to
2 bytes per sample. This causes a buffer overflow as each line copied
in the loop is twice the number of bytes it should be and the last
line writes off the end of the buffer.

BUG=aomedia:1389

Change-Id: Ib9fa11d1dd13806dedbce2cd47dd8d562007428d
parent 218556e2
......@@ -757,8 +757,8 @@ static void add_noise_to_block_hbd(aom_film_grain_t *params, uint16_t *luma,
static void copy_rect(uint8_t *src, int src_stride, uint8_t *dst,
int dst_stride, int width, int height,
int high_bit_depth) {
int hbd_coeff = high_bit_depth ? 2 : 0;
int use_high_bit_depth) {
int hbd_coeff = use_high_bit_depth ? 2 : 1;
while (height) {
memcpy(dst, src, width * sizeof(uint8_t) * hbd_coeff);
src += src_stride;
......@@ -781,17 +781,23 @@ void av1_add_film_grain(aom_film_grain_t *params, aom_image_t *src,
dst->r_w = src->r_w;
dst->r_h = src->r_h;
int use_high_bit_depth = 0;
if (dst->fmt == AOM_IMG_FMT_I42016) {
use_high_bit_depth = 1;
}
copy_rect(src->planes[AOM_PLANE_Y], src->stride[AOM_PLANE_Y],
dst->planes[AOM_PLANE_Y], dst->stride[AOM_PLANE_Y], dst->d_w,
dst->d_h, src->bit_depth);
dst->d_h, use_high_bit_depth);
copy_rect(src->planes[AOM_PLANE_U], src->stride[AOM_PLANE_U],
dst->planes[AOM_PLANE_U], dst->stride[AOM_PLANE_U], dst->d_w / 2,
dst->d_h / 2, src->bit_depth);
dst->d_h / 2, use_high_bit_depth);
copy_rect(src->planes[AOM_PLANE_V], src->stride[AOM_PLANE_V],
dst->planes[AOM_PLANE_V], dst->stride[AOM_PLANE_V], dst->d_w / 2,
dst->d_h / 2, src->bit_depth);
dst->d_h / 2, use_high_bit_depth);
luma = dst->planes[AOM_PLANE_Y];
cb = dst->planes[AOM_PLANE_U];
......@@ -805,12 +811,6 @@ void av1_add_film_grain(aom_film_grain_t *params, aom_image_t *src,
height = dst->d_h;
params->bit_depth = dst->bit_depth;
int use_high_bit_depth = 0;
if (dst->fmt == AOM_IMG_FMT_I42016) {
use_high_bit_depth = 1;
}
av1_add_film_grain_run(params, luma, cb, cr, height, width, luma_stride,
chroma_stride, use_high_bit_depth);
return;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment