walkero
/
openjpeg
1
0
Fork 0
Code Issues Pull Requests Projects Releases 1 Wiki Activity

wip: rework syc_420_to_rgb function to avoid buffer overflow

This commit is contained in:
Mehdi Sabwat 2022-05-13 00:31:12 +02:00
parent b239948ad9
commit 4802b4c318
1 changed files with 22 additions and 79 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

99
src/bin/common/color.c
View File

@ -211,6 +211,7 @@ static void sycc422_to_rgb(opj_image_t *img)
++cb; ++cb;
++cr; ++cr;
} }
if (j < loopmaxw) { if (j < loopmaxw) {
sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b); sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
++y; ++y;
@ -249,7 +250,9 @@ static void sycc420_to_rgb(opj_image_t *img)
size_t maxw, maxh, max, offx, loopmaxw, offy, loopmaxh; size_t maxw, maxh, max, offx, loopmaxw, offy, loopmaxh;
int offset, upb; int offset, upb;
size_t i; size_t i;
char cnt;
cnt = 0;
upb = (int)img->comps[0].prec; upb = (int)img->comps[0].prec;
offset = 1 << (upb - 1); offset = 1 << (upb - 1);
upb = (1 << upb) - 1; upb = (1 << upb) - 1;
@ -277,40 +280,19 @@ static void sycc420_to_rgb(opj_image_t *img)
offy = img->y0 & 1U; offy = img->y0 & 1U;
loopmaxh = maxh - offy; loopmaxh = maxh - offy;
if (offy > 0U) {
for (i = 0U; i < maxh; ++i) {
size_t j; size_t j;
for (j = 0; j < maxw; ++j) { if ((offx > 0U) || (offy > 0U)) {
sycc_to_rgb(offset, upb, *y, 0, 0, r, g, b); sycc_to_rgb(offset, upb, *y, 0, 0, r, g, b);
++y; ++y;
++r; ++r;
++g; ++g;
++b; ++b;
} }
}
for (i = 0U; i < (loopmaxh & ~(size_t)1U); i += 2U) { for (j = 0U; j < (loopmaxw & ~(size_t)1U); j += 2U) {
size_t j;
ny = y + maxw;
nr = r + maxw;
ng = g + maxw;
nb = b + maxw;
if (offx > 0U) {
sycc_to_rgb(offset, upb, *y, 0, 0, r, g, b);
++y;
++r;
++g;
++b;
sycc_to_rgb(offset, upb, *ny, *cb, *cr, nr, ng, nb);
++ny;
++nr;
++ng;
++nb;
}
for (j = 0; j < (loopmaxw & ~(size_t)1U); j += 2U) {
sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b); sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
++y; ++y;
++r; ++r;
@ -321,65 +303,26 @@ static void sycc420_to_rgb(opj_image_t *img)
++r; ++r;
++g; ++g;
++b; ++b;
cnt++;
if (cnt == 2) {
++cb;
++cr;
cnt = 0;
}
sycc_to_rgb(offset, upb, *ny, *cb, *cr, nr, ng, nb); }
++ny;
++nr; if ((j < loopmaxw) || (j < loopmaxh)) {
++ng; sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
++nb; ++y;
sycc_to_rgb(offset, upb, *ny, *cb, *cr, nr, ng, nb); ++r;
++ny; ++g;
++nr; ++b;
++ng;
++nb;
++cb; ++cb;
++cr; ++cr;
} }
if (j < loopmaxw) {
sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
++y;
++r;
++g;
++b;
sycc_to_rgb(offset, upb, *ny, *cb, *cr, nr, ng, nb);
++ny;
++nr;
++ng;
++nb;
++cb;
++cr;
}
y += maxw;
r += maxw;
g += maxw;
b += maxw;
}
if (i < loopmaxh) {
size_t j;
for (j = 0U; j < (maxw & ~(size_t)1U); j += 2U) {
sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
++y;
++r;
++g;
++b;
sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
if (*y != img->comps[0].data[max])
++y;
++r;
++g;
++b;
if (*cb != img->comps[1].data[max])
++cb;
if (*cr != img->comps[2].data[max])
++cr;
}
if (j < maxw) {
sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
}
} }
opj_image_data_free(img->comps[0].data); opj_image_data_free(img->comps[0].data);