admin/webrtc_m130
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "Fix for out-of-bounds write in square test frame generator."

Browse Source 
This reverts commit 30026214b13535a9fe1c47f1463378fbf976c643.

Reason for revert: Speculative revert, breaks downstream test.

Original change's description:
> Fix for out-of-bounds write in square test frame generator.
> 
> The length is set on construction and includes an assumption on the
> image resolution, if the resolution changes, a square might be larger
> than what fits into the buffer, causing an out of bounds write. This
> CL fixes this simply by restricting the size of the square.
> 
> Bug: webrtc:11415
> Change-Id: Iee14a1971997b4ae2fddef0a7af7c76a2509e879
> Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/170042
> Commit-Queue: Sebastian Jansson <srte@webrtc.org>
> Reviewed-by: Ali Tofigh <alito@webrtc.org>
> Cr-Commit-Position: refs/heads/master@{#30732}

TBR=srte@webrtc.org,alito@webrtc.org

Change-Id: Ia0056da04a6f6f817ccadfc38aabe0c5f94754cc
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: webrtc:11415
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/170115
Reviewed-by: Mirko Bonadei <mbonadei@webrtc.org>
Commit-Queue: Mirko Bonadei <mbonadei@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#30743}
This commit is contained in:
Mirko Bonadei 2020-03-10 16:18:52 +00:00 committed by Commit Bot
parent ce588ae61d
commit 1230c8568e
2 changed files with 10 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
test/frame_generator.cc
View File

@ -116,23 +116,21 @@ void SquareGenerator::Square::Draw(
RTC_DCHECK(frame_buffer->type() == VideoFrameBuffer::Type::kI420 || RTC_DCHECK(frame_buffer->type() == VideoFrameBuffer::Type::kI420 ||
frame_buffer->type() == VideoFrameBuffer::Type::kI420A); frame_buffer->type() == VideoFrameBuffer::Type::kI420A);
rtc::scoped_refptr<I420BufferInterface> buffer = frame_buffer->ToI420(); rtc::scoped_refptr<I420BufferInterface> buffer = frame_buffer->ToI420();
int length_cap = std::min(buffer->height(), buffer->width()) / 4; x_ = (x_ + random_generator_.Rand(0, 4)) % (buffer->width() - length_);
int length = std::min(length_, length_cap); y_ = (y_ + random_generator_.Rand(0, 4)) % (buffer->height() - length_);
x_ = (x_ + random_generator_.Rand(0, 4)) % (buffer->width() - length); for (int y = y_; y < y_ + length_; ++y) {
y_ = (y_ + random_generator_.Rand(0, 4)) % (buffer->height() - length);
for (int y = y_; y < y_ + length; ++y) {
uint8_t* pos_y = uint8_t* pos_y =
(const_cast<uint8_t*>(buffer->DataY()) + x_ + y * buffer->StrideY()); (const_cast<uint8_t*>(buffer->DataY()) + x_ + y * buffer->StrideY());
memset(pos_y, yuv_y_, length); memset(pos_y, yuv_y_, length_);
} }
for (int y = y_; y < y_ + length; y = y + 2) { for (int y = y_; y < y_ + length_; y = y + 2) {
uint8_t* pos_u = (const_cast<uint8_t*>(buffer->DataU()) + x_ / 2 + uint8_t* pos_u = (const_cast<uint8_t*>(buffer->DataU()) + x_ / 2 +
y / 2 * buffer->StrideU()); y / 2 * buffer->StrideU());
memset(pos_u, yuv_u_, length / 2); memset(pos_u, yuv_u_, length_ / 2);
uint8_t* pos_v = (const_cast<uint8_t*>(buffer->DataV()) + x_ / 2 + uint8_t* pos_v = (const_cast<uint8_t*>(buffer->DataV()) + x_ / 2 +
y / 2 * buffer->StrideV()); y / 2 * buffer->StrideV());
memset(pos_v, yuv_v_, length / 2); memset(pos_v, yuv_v_, length_ / 2);
} }
if (frame_buffer->type() == VideoFrameBuffer::Type::kI420) if (frame_buffer->type() == VideoFrameBuffer::Type::kI420)
@ -140,10 +138,10 @@ void SquareGenerator::Square::Draw(
// Optionally draw on alpha plane if given. // Optionally draw on alpha plane if given.
const webrtc::I420ABufferInterface* yuva_buffer = frame_buffer->GetI420A(); const webrtc::I420ABufferInterface* yuva_buffer = frame_buffer->GetI420A();
for (int y = y_; y < y_ + length; ++y) { for (int y = y_; y < y_ + length_; ++y) {
uint8_t* pos_y = (const_cast<uint8_t*>(yuva_buffer->DataA()) + x_ + uint8_t* pos_y = (const_cast<uint8_t*>(yuva_buffer->DataA()) + x_ +
y * yuva_buffer->StrideA()); y * yuva_buffer->StrideA());
memset(pos_y, yuv_a_, length); memset(pos_y, yuv_a_, length_);
} }
} }

2
test/testsupport/ivf_video_frame_generator_unittest.cc
View File

@ -48,7 +48,7 @@ constexpr int kMaxFrameEncodeWaitTimeoutMs = 2000;
static const VideoEncoder::Capabilities kCapabilities(false); static const VideoEncoder::Capabilities kCapabilities(false);
#if defined(WEBRTC_ANDROID) || defined(WEBRTC_IOS) #if defined(WEBRTC_ANDROID) || defined(WEBRTC_IOS)
constexpr double kExpectedMinPsnr = 35; constexpr double kExpectedMinPsnr = 36;
#else #else
constexpr double kExpectedMinPsnr = 39; constexpr double kExpectedMinPsnr = 39;
#endif #endif