commit aa5904ba153bede9c5a3a9b8ac7ad31dcff55726
author Dominic Symes <dominic.symes@arm.com> Wed Feb 14 14:53:24 2018 +0100
committer Yaowu Xu <yaowu@google.com> Thu Feb 15 17:38:30 2018 +0000
tree 952b60da43dc63644b00997a5b48c15976c4e24e
parent 218556e2864982e8a70e44c445335802dd1c9b1e

film-grain: fix buffer overflow

When bit_depth is 8 the copy_rect function was setting the size to
2 bytes per sample. This causes a buffer overflow as each line copied
in the loop is twice the number of bytes it should be and the last
line writes off the end of the buffer.

BUG=aomedia:1389

Change-Id: Ib9fa11d1dd13806dedbce2cd47dd8d562007428d

aom_dsp/grain_synthesis.c

diff --git a/aom_dsp/grain_synthesis.c b/aom_dsp/grain_synthesis.c
index 78e7e30..cd6cbf0 100644
--- a/aom_dsp/grain_synthesis.c
+++ b/aom_dsp/grain_synthesis.c
@@ -757,8 +757,8 @@
 
 static void copy_rect(uint8_t *src, int src_stride, uint8_t *dst,
                       int dst_stride, int width, int height,
-                      int high_bit_depth) {
-  int hbd_coeff = high_bit_depth ? 2 : 0;
+                      int use_high_bit_depth) {
+  int hbd_coeff = use_high_bit_depth ? 2 : 1;
   while (height) {
     memcpy(dst, src, width * sizeof(uint8_t) * hbd_coeff);
     src += src_stride;
@@ -781,17 +781,23 @@
   dst->r_w = src->r_w;
   dst->r_h = src->r_h;
 
+  int use_high_bit_depth = 0;
+
+  if (dst->fmt == AOM_IMG_FMT_I42016) {
+    use_high_bit_depth = 1;
+  }
+
   copy_rect(src->planes[AOM_PLANE_Y], src->stride[AOM_PLANE_Y],
             dst->planes[AOM_PLANE_Y], dst->stride[AOM_PLANE_Y], dst->d_w,
-            dst->d_h, src->bit_depth);
+            dst->d_h, use_high_bit_depth);
 
   copy_rect(src->planes[AOM_PLANE_U], src->stride[AOM_PLANE_U],
             dst->planes[AOM_PLANE_U], dst->stride[AOM_PLANE_U], dst->d_w / 2,
-            dst->d_h / 2, src->bit_depth);
+            dst->d_h / 2, use_high_bit_depth);
 
   copy_rect(src->planes[AOM_PLANE_V], src->stride[AOM_PLANE_V],
             dst->planes[AOM_PLANE_V], dst->stride[AOM_PLANE_V], dst->d_w / 2,
-            dst->d_h / 2, src->bit_depth);
+            dst->d_h / 2, use_high_bit_depth);
 
   luma = dst->planes[AOM_PLANE_Y];
   cb = dst->planes[AOM_PLANE_U];
@@ -805,12 +811,6 @@
   height = dst->d_h;
   params->bit_depth = dst->bit_depth;
 
-  int use_high_bit_depth = 0;
-
-  if (dst->fmt == AOM_IMG_FMT_I42016) {
-    use_high_bit_depth = 1;
-  }
-
   av1_add_film_grain_run(params, luma, cb, cr, height, width, luma_stride,
                          chroma_stride, use_high_bit_depth);
   return;