From c4c7541ce74502f30d8025ade5df37c9efcfe609 Mon Sep 17 00:00:00 2001 From: Jerome Jiang Date: Tue, 10 Oct 2017 23:04:18 +0000 Subject: Revert "libvpx: Fix security issue caused by odd frame width." This reverts commit 43b31a9756b772bb92ea9788a90755976a4f5639. That commit changed the alignment behavior when there is no external allocation, which is unnecessary to address this issue. Bug: b/64710201 Test: Revert a previous CL. Change-Id: Id8f7fb9bce0f742ee14d0616eebdd99403692c2e --- libvpx/vpx/src/vpx_image.c | 24 ++++++++---------------- 1 file changed, 8 insertions(+), 16 deletions(-) (limited to 'libvpx') diff --git a/libvpx/vpx/src/vpx_image.c b/libvpx/vpx/src/vpx_image.c index ebd3d7f74..dba439c10 100644 --- a/libvpx/vpx/src/vpx_image.c +++ b/libvpx/vpx/src/vpx_image.c @@ -88,10 +88,11 @@ static vpx_image_t *img_alloc_helper(vpx_image_t *img, vpx_img_fmt_t fmt, default: ycs = 0; break; } - /* Calculate storage sizes. If the buffer was allocated externally, the width - * and height shouldn't be adjusted. */ - w = d_w; - h = d_h; + /* Calculate storage sizes given the chroma subsampling */ + align = (1 << xcs) - 1; + w = (d_w + align) & ~align; + align = (1 << ycs) - 1; + h = (d_h + align) & ~align; s = (fmt & VPX_IMG_FMT_PLANAR) ? w : bps * w / 8; s = (s + stride_align - 1) & ~(stride_align - 1); stride_in_bytes = (fmt & VPX_IMG_FMT_HIGHBITDEPTH) ? s * 2 : s; @@ -110,18 +111,9 @@ static vpx_image_t *img_alloc_helper(vpx_image_t *img, vpx_img_fmt_t fmt, img->img_data = img_data; if (!img_data) { - uint64_t alloc_size; - /* Calculate storage sizes given the chroma subsampling */ - align = xcs ? (1 << xcs) - 1 : 1; - w = (d_w + align - 1) & ~(align - 1); - align = ycs ? (1 << ycs) - 1 : 1; - h = (d_h + align - 1) & ~(align - 1); - - s = (fmt & VPX_IMG_FMT_PLANAR) ? w : bps * w / 8; - s = (s + stride_align - 1) & ~(stride_align - 1); - stride_in_bytes = (fmt & VPX_IMG_FMT_HIGHBITDEPTH) ? s * 2 : s; - alloc_size = (fmt & VPX_IMG_FMT_PLANAR) ? (uint64_t)h * s * bps / 8 - : (uint64_t)h * s; + const uint64_t alloc_size = (fmt & VPX_IMG_FMT_PLANAR) + ? (uint64_t)h * s * bps / 8 + : (uint64_t)h * s; if (alloc_size != (size_t)alloc_size) goto fail; -- cgit v1.2.3