dany/libwebp
1
0
Fork 0
mirror of https://github.com/webmproject/libwebp.git synced 2025-09-01 00:32:07 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

Adds fbounds annotations for VP8LColorCache.

Browse Source 
Reasoning:

Analysis of `VP8LColorCacheInit`
(src/utils/color_cache_utils.c:29) revealed that `colors` is allocated
using `WebPSafeCalloc` with a size of `1 << hash_bits`. Therefore,
`colors` was annotated with `WEBP_COUNTED_BY_OR_NULL(1u << hash_bits)`.
To support this, `WebPSafeCalloc` (src/utils/utils.h:59,
src/utils/utils.c:214) was annotated to return
`WEBP_SIZED_BY_OR_NULL(nmemb * size)`. Since `WebPSafeCalloc` returns a
local pointer that defaults to unsafe when bounds safety is suppressed,
`WEBP_UNSAFE_FORGE_BIDI_INDEXABLE` was used on the return value
(src/utils/utils.c:222). Similarly, `VP8LColorCacheInit` required
`WEBP_UNSAFE_FORGE_BIDI_INDEXABLE` when assigning the allocated pointer
to the struct field (src/utils/color_cache_utils.c:47). Finally,
`VP8LColorCacheInit` and `VP8LColorCacheClear` were modified to perform
side-by-side assignments to `colors` and `hash_bits` as required by the
`WEBP_COUNTED_BY_OR_NULL` annotation, using self-assignment for
`hash_bits` when necessary to maintain functional equivalence with the
original code.

Bug: 432511821
Change-Id: I63cb46909d883a2e8932043ac3117b05b37e8d40
This commit is contained in:
Arman Hasanzadeh
2025-08-15 12:32:50 -07:00
parent 456e2cbce1
commit ac865676a9
4 changed files with 17 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/utils/utils.c
View File

@@ -211,14 +211,15 @@ void* WebPSafeMalloc(uint64_t nmemb, size_t size) {
return ptr;
}
void* WebPSafeCalloc(uint64_t nmemb, size_t size) {
void* WEBP_SIZED_BY_OR_NULL(nmemb* size)
WebPSafeCalloc(uint64_t nmemb, size_t size) {
void* ptr;
Increment(&num_calloc_calls);
if (!CheckSizeArgumentsOverflow(nmemb, size)) return NULL;
assert(nmemb * size > 0);
ptr = calloc((size_t)nmemb, size);
AddMem(ptr, (size_t)(nmemb * size));
return ptr;
return WEBP_UNSAFE_FORGE_BIDI_INDEXABLE(void*, ptr, (size_t)(nmemb * size));
}
void WebPSafeFree(void* const ptr) {