tree 66ecfa3dc1895d926a3b03eaff188030f8a0324e
parent 8e7964ae3d874c8b5d335f7a6b1b4e29414fea38
author Jerome Jiang <jianj@google.com> 1771620604 -0500
committer Jerome Jiang <jianj@google.com> 1771958337 -0800

Use crop dimensions for extension calculation

This fixes a heap-buffer-overflow bug where extension sizes (er_y, eb_y)
were calculated using storage dimensions (y_width, y_height) instead of
crop dimensions (y_crop_width, y_crop_height). When size_align is large,
the storage dimensions can exceed the crop dimensions significantly,
leading to an inflated extension size that causes copy_and_extend_plane
to write past the allocated buffer bounds.

Bug: aomedia:480978101
Change-Id: I731e51f818f64183eba3377fc5b69782878b29e6