replace 'ptr + y * stride' by 'ptr += stride'

This is to prevent potential overflow.

Change-Id: I9d21cfe790ba975bd5e117b025ea4d9deaeae4ab
This commit is contained in:
Pascal Massimino
2017-01-04 00:54:23 -08:00
parent 00b08c88c0
commit 259e98286a
4 changed files with 134 additions and 98 deletions

View File

@ -150,6 +150,7 @@ static int DumpFrame(const char filename[], const char dump_folder[],
const char* base_name = NULL;
char* file_name = NULL;
FILE* f = NULL;
const char* row;
base_name = strrchr(filename, '/');
base_name = (base_name == NULL) ? filename : base_name + 1;
@ -176,12 +177,13 @@ static int DumpFrame(const char filename[], const char dump_folder[],
fprintf(stderr, "Write error for file %s\n", file_name);
goto End;
}
row = (const char*)rgba;
for (y = 0; y < canvas_height; ++y) {
if (fwrite((const char*)(rgba) + y * canvas_width * kNumChannels,
canvas_width * kNumChannels, 1, f) != 1) {
if (fwrite(row, canvas_width * kNumChannels, 1, f) != 1) {
fprintf(stderr, "Error writing to file: %s\n", file_name);
goto End;
}
row += canvas_width * kNumChannels;
}
ok = 1;
End:
@ -743,7 +745,7 @@ void GetDiffAndPSNR(const uint8_t rgba1[], const uint8_t rgba2[],
for (y = 0; y < height; ++y) {
for (x = 0; x < stride; x += kNumChannels) {
int k;
const size_t offset = y * stride + x;
const size_t offset = (size_t)y * stride + x;
const int alpha1 = rgba1[offset + kAlphaChannel];
const int alpha2 = rgba2[offset + kAlphaChannel];
Accumulate(alpha1, alpha2, &f_max_diff, &sse);

View File

@ -297,6 +297,10 @@ static int DumpPicture(const WebPPicture* const picture, const char* PGM_name) {
const int uv_width = (picture->width + 1) / 2;
const int uv_height = (picture->height + 1) / 2;
const int stride = (picture->width + 1) & ~1;
const uint8_t* src_y = picture->y;
const uint8_t* src_u = picture->u;
const uint8_t* src_v = picture->v;
const uint8_t* src_a = picture->a;
const int alpha_height =
WebPPictureHasTransparency(picture) ? picture->height : 0;
const int height = picture->height + uv_height + alpha_height;
@ -304,24 +308,20 @@ static int DumpPicture(const WebPPicture* const picture, const char* PGM_name) {
if (f == NULL) return 0;
fprintf(f, "P5\n%d %d\n255\n", stride, height);
for (y = 0; y < picture->height; ++y) {
if (fwrite(picture->y + y * picture->y_stride, picture->width, 1, f) != 1) {
return 0;
}
if (fwrite(src_y, picture->width, 1, f) != 1) return 0;
if (picture->width & 1) fputc(0, f); // pad
src_y += picture->y_stride;
}
for (y = 0; y < uv_height; ++y) {
if (fwrite(picture->u + y * picture->uv_stride, uv_width, 1, f) != 1) {
return 0;
}
if (fwrite(picture->v + y * picture->uv_stride, uv_width, 1, f) != 1) {
return 0;
}
if (fwrite(src_u, uv_width, 1, f) != 1) return 0;
if (fwrite(src_v, uv_width, 1, f) != 1) return 0;
src_u += picture->uv_stride;
src_v += picture->uv_stride;
}
for (y = 0; y < alpha_height; ++y) {
if (fwrite(picture->a + y * picture->a_stride, picture->width, 1, f) != 1) {
return 0;
}
if (fwrite(src_a, picture->width, 1, f) != 1) return 0;
if (picture->width & 1) fputc(0, f); // pad
src_a += picture->a_stride;
}
fclose(f);
return 1;