mirrors/gstreamer
mirrors/gstreamer
1
1
Fork 0
mirror of https://gitlab.freedesktop.org/gstreamer/gstreamer.git synced 2025-02-06 14:32:31 +00:00
Code Issues 1 Projects Releases Wiki Activity

videoflip: Fix buffer overflow bug for odd resolutions and Y422 colorspaces

Browse source 
https://bugzilla.gnome.org/show_bug.cgi?id=644773
This commit is contained in:
Youness Alaoui 2011-03-14 19:14:07 -04:00 committed by Tim-Philipp Müller
parent 56edbd0fa3
commit a1a0186a62
1 changed files with 52 additions and 32 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

84
gst/videofilter/gstvideoflip.c
View file

@ -611,16 +611,22 @@ gst_video_flip_y422 (GstVideoFlip * videoflip, guint8 * dest,
/* u/v must be calculated using the offset of the even column */ /* u/v must be calculated using the offset of the even column */
gint even_y = (y & ~1); gint even_y = (y & ~1);
u = (s[(sh - 1 - x) * src_stride + even_y * bpp + u_offset] + u = s[(sh - 1 - x) * src_stride + even_y * bpp + u_offset];
s[(sh - 1 - (x + 1)) * src_stride + even_y * bpp + u_offset]) / 2; if (x + 1 < dw)
v = (s[(sh - 1 - x) * src_stride + even_y * bpp + v_offset] + u = (s[(sh - 1 - (x + 1)) * src_stride + even_y * bpp + u_offset]
s[(sh - 1 - (x + 1)) * src_stride + even_y * bpp + v_offset]) / 2; + u) >> 1;
v = s[(sh - 1 - x) * src_stride + even_y * bpp + v_offset];
if (x + 1 < dw)
v = (s[(sh - 1 - (x + 1)) * src_stride + even_y * bpp + v_offset]
+ v) >> 1;
d[y * dest_stride + x * bpp + u_offset] = u; d[y * dest_stride + x * bpp + u_offset] = u;
d[y * dest_stride + x * bpp + v_offset] = v; d[y * dest_stride + x * bpp + v_offset] = v;
d[y * dest_stride + x * bpp + y_offset] = d[y * dest_stride + x * bpp + y_offset] =
s[(sh - 1 - x) * src_stride + y * bpp + y_offset]; s[(sh - 1 - x) * src_stride + y * bpp + y_offset];
d[y * dest_stride + (x + 1) * bpp + y_offset] = if (x + 1 < dw)
s[(sh - 1 - (x + 1)) * src_stride + y * bpp + y_offset]; d[y * dest_stride + (x + 1) * bpp + y_offset] =
s[(sh - 1 - (x + 1)) * src_stride + y * bpp + y_offset];
} }
} }
break; break;
@ -632,17 +638,20 @@ gst_video_flip_y422 (GstVideoFlip * videoflip, guint8 * dest,
/* u/v must be calculated using the offset of the even column */ /* u/v must be calculated using the offset of the even column */
gint even_y = ((sw - 1 - y) & ~1); gint even_y = ((sw - 1 - y) & ~1);
u = (s[x * src_stride + even_y * bpp + u_offset] + u = s[x * src_stride + even_y * bpp + u_offset];
s[(x + 1) * src_stride + even_y * bpp + u_offset]) / 2; if (x + 1 < dw)
v = (s[x * src_stride + even_y * bpp + v_offset] + u = (s[(x + 1) * src_stride + even_y * bpp + u_offset] + u) >> 1;
s[(x + 1) * src_stride + even_y * bpp + v_offset]) / 2; v = s[x * src_stride + even_y * bpp + v_offset];
if (x + 1 < dw)
v = (s[(x + 1) * src_stride + even_y * bpp + v_offset] + v) >> 1;
d[y * dest_stride + x * bpp + u_offset] = u; d[y * dest_stride + x * bpp + u_offset] = u;
d[y * dest_stride + x * bpp + v_offset] = v; d[y * dest_stride + x * bpp + v_offset] = v;
d[y * dest_stride + x * bpp + y_offset] = d[y * dest_stride + x * bpp + y_offset] =
s[x * src_stride + (sw - 1 - y) * bpp + y_offset]; s[x * src_stride + (sw - 1 - y) * bpp + y_offset];
d[y * dest_stride + (x + 1) * bpp + y_offset] = if (x + 1 < dw)
s[(x + 1) * src_stride + (sw - 1 - y) * bpp + y_offset]; d[y * dest_stride + (x + 1) * bpp + y_offset] =
s[(x + 1) * src_stride + (sw - 1 - y) * bpp + y_offset];
} }
} }
break; break;
@ -663,9 +672,10 @@ gst_video_flip_y422 (GstVideoFlip * videoflip, guint8 * dest,
d[y * dest_stride + x * bpp + v_offset] = v; d[y * dest_stride + x * bpp + v_offset] = v;
d[y * dest_stride + x * bpp + y_offset] = d[y * dest_stride + x * bpp + y_offset] =
s[(sh - 1 - y) * src_stride + (sw - 1 - x) * bpp + y_offset]; s[(sh - 1 - y) * src_stride + (sw - 1 - x) * bpp + y_offset];
d[y * dest_stride + (x + 1) * bpp + y_offset] = if (x + 1 < dw)
s[(sh - 1 - y) * src_stride + (sw - 1 - (x + 1)) * bpp + d[y * dest_stride + (x + 1) * bpp + y_offset] =
y_offset]; s[(sh - 1 - y) * src_stride + (sw - 1 - (x + 1)) * bpp +
y_offset];
} }
} }
break; break;
@ -686,8 +696,9 @@ gst_video_flip_y422 (GstVideoFlip * videoflip, guint8 * dest,
d[y * dest_stride + x * bpp + v_offset] = v; d[y * dest_stride + x * bpp + v_offset] = v;
d[y * dest_stride + x * bpp + y_offset] = d[y * dest_stride + x * bpp + y_offset] =
s[y * src_stride + (sw - 1 - x) * bpp + y_offset]; s[y * src_stride + (sw - 1 - x) * bpp + y_offset];
d[y * dest_stride + (x + 1) * bpp + y_offset] = if (x + 1 < dw)
s[y * src_stride + (sw - 1 - (x + 1)) * bpp + y_offset]; d[y * dest_stride + (x + 1) * bpp + y_offset] =
s[y * src_stride + (sw - 1 - (x + 1)) * bpp + y_offset];
} }
} }
break; break;
@ -708,8 +719,9 @@ gst_video_flip_y422 (GstVideoFlip * videoflip, guint8 * dest,
d[y * dest_stride + x * bpp + v_offset] = v; d[y * dest_stride + x * bpp + v_offset] = v;
d[y * dest_stride + x * bpp + y_offset] = d[y * dest_stride + x * bpp + y_offset] =
s[(sh - 1 - y) * src_stride + x * bpp + y_offset]; s[(sh - 1 - y) * src_stride + x * bpp + y_offset];
d[y * dest_stride + (x + 1) * bpp + y_offset] = if (x + 1 < dw)
s[(sh - 1 - y) * src_stride + (x + 1) * bpp + y_offset]; d[y * dest_stride + (x + 1) * bpp + y_offset] =
s[(sh - 1 - y) * src_stride + (x + 1) * bpp + y_offset];
} }
} }
break; break;
@ -721,17 +733,20 @@ gst_video_flip_y422 (GstVideoFlip * videoflip, guint8 * dest,
/* u/v must be calculated using the offset of the even column */ /* u/v must be calculated using the offset of the even column */
gint even_y = (y & ~1); gint even_y = (y & ~1);
u = (s[x * src_stride + even_y * bpp + u_offset] + u = s[x * src_stride + even_y * bpp + u_offset];
s[(x + 1) * src_stride + even_y * bpp + u_offset]) / 2; if (x + 1 < dw)
v = (s[x * src_stride + even_y * bpp + v_offset] + u = (s[(x + 1) * src_stride + even_y * bpp + u_offset] + u) >> 1;
s[(x + 1) * src_stride + even_y * bpp + v_offset]) / 2; v = s[x * src_stride + even_y * bpp + v_offset];
if (x + 1 < dw)
v = (s[(x + 1) * src_stride + even_y * bpp + v_offset] + v) >> 1;
d[y * dest_stride + x * bpp + u_offset] = u; d[y * dest_stride + x * bpp + u_offset] = u;
d[y * dest_stride + x * bpp + v_offset] = v; d[y * dest_stride + x * bpp + v_offset] = v;
d[y * dest_stride + x * bpp + y_offset] = d[y * dest_stride + x * bpp + y_offset] =
s[x * src_stride + y * bpp + y_offset]; s[x * src_stride + y * bpp + y_offset];
d[y * dest_stride + (x + 1) * bpp + y_offset] = if (x + 1 < dw)
s[(x + 1) * src_stride + y * bpp + y_offset]; d[y * dest_stride + (x + 1) * bpp + y_offset] =
s[(x + 1) * src_stride + y * bpp + y_offset];
} }
} }
break; break;
@ -743,18 +758,23 @@ gst_video_flip_y422 (GstVideoFlip * videoflip, guint8 * dest,
/* u/v must be calculated using the offset of the even column */ /* u/v must be calculated using the offset of the even column */
gint even_y = ((sw - 1 - y) & ~1); gint even_y = ((sw - 1 - y) & ~1);
u = (s[(sh - 1 - x) * src_stride + even_y * bpp + u_offset] + u = s[(sh - 1 - x) * src_stride + even_y * bpp + u_offset];
s[(sh - 1 - (x + 1)) * src_stride + even_y * bpp + u_offset]) / 2; if (x + 1 < dw)
v = (s[(sh - 1 - x) * src_stride + even_y * bpp + v_offset] + u = (s[(sh - 1 - (x + 1)) * src_stride + even_y * bpp + u_offset]
s[(sh - 1 - (x + 1)) * src_stride + even_y * bpp + v_offset]) / 2; + u) >> 1;
v = s[(sh - 1 - x) * src_stride + even_y * bpp + v_offset];
if (x + 1 < dw)
v = (s[(sh - 1 - (x + 1)) * src_stride + even_y * bpp + v_offset]
+ v) >> 1;
d[y * dest_stride + x * bpp + u_offset] = u; d[y * dest_stride + x * bpp + u_offset] = u;
d[y * dest_stride + x * bpp + v_offset] = v; d[y * dest_stride + x * bpp + v_offset] = v;
d[y * dest_stride + x * bpp + y_offset] = d[y * dest_stride + x * bpp + y_offset] =
s[(sh - 1 - x) * src_stride + (sw - 1 - y) * bpp + y_offset]; s[(sh - 1 - x) * src_stride + (sw - 1 - y) * bpp + y_offset];
d[y * dest_stride + (x + 1) * bpp + y_offset] = if (x + 1 < dw)
s[(sh - 1 - (x + 1)) * src_stride + (sw - 1 - y) * bpp + d[y * dest_stride + (x + 1) * bpp + y_offset] =
y_offset]; s[(sh - 1 - (x + 1)) * src_stride + (sw - 1 - y) * bpp +
y_offset];
} }
} }
break; break;