Impose a smaller maximum frame dimension of 32768 Avoid integer overflows when multiplying width by height using the int type. Bug: aomedia:3508 Change-Id: Ib9064896efb811ba67f50588ea330d4386f06f24
diff --git a/av1/av1_cx_iface.c b/av1/av1_cx_iface.c index 689af2a..719859d 100644 --- a/av1/av1_cx_iface.c +++ b/av1/av1_cx_iface.c
@@ -636,10 +636,14 @@ static aom_codec_err_t validate_config(aom_codec_alg_priv_t *ctx, const aom_codec_enc_cfg_t *cfg, const struct av1_extracfg *extra_cfg) { - RANGE_CHECK(cfg, g_w, 1, 65536); // 16 bits available - RANGE_CHECK(cfg, g_h, 1, 65536); // 16 bits available - RANGE_CHECK_HI(cfg, g_forced_max_frame_width, 65536); // 16 bits available - RANGE_CHECK_HI(cfg, g_forced_max_frame_height, 65536); // 16 bits available + // The AV1 specification allows a maximum frame dimension (width or height) + // of 65536 (= 2^16). To avoid integer overflows when multiplying width by + // height (or values derived from width and height) using the int type, + // impose a smaller maximum frame dimension of 32768 (= 2^15). + RANGE_CHECK(cfg, g_w, 1, 32768); + RANGE_CHECK(cfg, g_h, 1, 32768); + RANGE_CHECK_HI(cfg, g_forced_max_frame_width, 32768); + RANGE_CHECK_HI(cfg, g_forced_max_frame_height, 32768); if (cfg->g_forced_max_frame_width) { RANGE_CHECK_HI(cfg, g_w, cfg->g_forced_max_frame_width); }
diff --git a/test/encode_api_test.cc b/test/encode_api_test.cc index e80f09e..eecc723 100644 --- a/test/encode_api_test.cc +++ b/test/encode_api_test.cc
@@ -66,6 +66,18 @@ EXPECT_EQ(AOM_CODEC_INVALID_PARAM, aom_codec_enc_config_default(iface, &cfg, 3)); EXPECT_EQ(AOM_CODEC_OK, aom_codec_enc_config_default(iface, &cfg, kUsage)); + cfg.g_w = (1 << 15) + 1; + EXPECT_EQ(AOM_CODEC_INVALID_PARAM, aom_codec_enc_init(&enc, iface, &cfg, 0)); + EXPECT_EQ(AOM_CODEC_OK, aom_codec_enc_config_default(iface, &cfg, kUsage)); + cfg.g_h = (1 << 15) + 1; + EXPECT_EQ(AOM_CODEC_INVALID_PARAM, aom_codec_enc_init(&enc, iface, &cfg, 0)); + EXPECT_EQ(AOM_CODEC_OK, aom_codec_enc_config_default(iface, &cfg, kUsage)); + cfg.g_forced_max_frame_width = (1 << 15) + 1; + EXPECT_EQ(AOM_CODEC_INVALID_PARAM, aom_codec_enc_init(&enc, iface, &cfg, 0)); + EXPECT_EQ(AOM_CODEC_OK, aom_codec_enc_config_default(iface, &cfg, kUsage)); + cfg.g_forced_max_frame_height = (1 << 15) + 1; + EXPECT_EQ(AOM_CODEC_INVALID_PARAM, aom_codec_enc_init(&enc, iface, &cfg, 0)); + EXPECT_EQ(AOM_CODEC_OK, aom_codec_enc_config_default(iface, &cfg, kUsage)); EXPECT_EQ(AOM_CODEC_OK, aom_codec_enc_init(&enc, iface, &cfg, 0)); EXPECT_EQ(nullptr, aom_codec_get_global_headers(nullptr));