A buffer whose size is not a multiple of four has been initialized using consecutive writes of 32bits. This results in a stack-buffer-overflow reported by ASAN in the checkasm-sw_scale FATE-test. Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
		
			
				
	
	
		
			135 lines
		
	
	
		
			4.6 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			135 lines
		
	
	
		
			4.6 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
/*
 | 
						|
 *
 | 
						|
 * This file is part of FFmpeg.
 | 
						|
 *
 | 
						|
 * FFmpeg is free software; you can redistribute it and/or modify
 | 
						|
 * it under the terms of the GNU General Public License as published by
 | 
						|
 * the Free Software Foundation; either version 2 of the License, or
 | 
						|
 * (at your option) any later version.
 | 
						|
 *
 | 
						|
 * FFmpeg is distributed in the hope that it will be useful,
 | 
						|
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 | 
						|
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 | 
						|
 * GNU General Public License for more details.
 | 
						|
 *
 | 
						|
 * You should have received a copy of the GNU General Public License along
 | 
						|
 * with FFmpeg; if not, write to the Free Software Foundation, Inc.,
 | 
						|
 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 | 
						|
 */
 | 
						|
 | 
						|
#include <string.h>
 | 
						|
 | 
						|
#include "libavutil/common.h"
 | 
						|
#include "libavutil/intreadwrite.h"
 | 
						|
#include "libavutil/mem.h"
 | 
						|
 | 
						|
#include "libswscale/swscale.h"
 | 
						|
#include "libswscale/swscale_internal.h"
 | 
						|
 | 
						|
#include "checkasm.h"
 | 
						|
 | 
						|
#define randomize_buffers(buf, size)      \
 | 
						|
    do {                                  \
 | 
						|
        int j;                            \
 | 
						|
        for (j = 0; j < size; j+=4)       \
 | 
						|
            AV_WN32(buf + j, rnd());      \
 | 
						|
    } while (0)
 | 
						|
 | 
						|
#define SRC_PIXELS 128
 | 
						|
 | 
						|
static void check_hscale(void)
 | 
						|
{
 | 
						|
#define MAX_FILTER_WIDTH 40
 | 
						|
#define FILTER_SIZES 5
 | 
						|
    static const int filter_sizes[FILTER_SIZES] = { 4, 8, 16, 32, 40 };
 | 
						|
 | 
						|
#define HSCALE_PAIRS 2
 | 
						|
    static const int hscale_pairs[HSCALE_PAIRS][2] = {
 | 
						|
        { 8, 14 },
 | 
						|
        { 8, 18 },
 | 
						|
    };
 | 
						|
 | 
						|
    int i, j, fsi, hpi, width;
 | 
						|
    struct SwsContext *ctx;
 | 
						|
 | 
						|
    // padded
 | 
						|
    LOCAL_ALIGNED_32(uint8_t, src, [FFALIGN(SRC_PIXELS + MAX_FILTER_WIDTH - 1, 4)]);
 | 
						|
    LOCAL_ALIGNED_32(uint32_t, dst0, [SRC_PIXELS]);
 | 
						|
    LOCAL_ALIGNED_32(uint32_t, dst1, [SRC_PIXELS]);
 | 
						|
 | 
						|
    // padded
 | 
						|
    LOCAL_ALIGNED_32(int16_t, filter, [SRC_PIXELS * MAX_FILTER_WIDTH + MAX_FILTER_WIDTH]);
 | 
						|
    LOCAL_ALIGNED_32(int32_t, filterPos, [SRC_PIXELS]);
 | 
						|
 | 
						|
    // The dst parameter here is either int16_t or int32_t but we use void* to
 | 
						|
    // just cover both cases.
 | 
						|
    declare_func_emms(AV_CPU_FLAG_MMX, void, void *c, void *dst, int dstW,
 | 
						|
                      const uint8_t *src, const int16_t *filter,
 | 
						|
                      const int32_t *filterPos, int filterSize);
 | 
						|
 | 
						|
    ctx = sws_alloc_context();
 | 
						|
    if (sws_init_context(ctx, NULL, NULL) < 0)
 | 
						|
        fail();
 | 
						|
 | 
						|
    randomize_buffers(src, SRC_PIXELS + MAX_FILTER_WIDTH - 1);
 | 
						|
 | 
						|
    for (hpi = 0; hpi < HSCALE_PAIRS; hpi++) {
 | 
						|
        for (fsi = 0; fsi < FILTER_SIZES; fsi++) {
 | 
						|
            width = filter_sizes[fsi];
 | 
						|
 | 
						|
            ctx->srcBpc = hscale_pairs[hpi][0];
 | 
						|
            ctx->dstBpc = hscale_pairs[hpi][1];
 | 
						|
            ctx->hLumFilterSize = ctx->hChrFilterSize = width;
 | 
						|
 | 
						|
            for (i = 0; i < SRC_PIXELS; i++) {
 | 
						|
                filterPos[i] = i;
 | 
						|
 | 
						|
                // These filter cofficients are chosen to try break two corner
 | 
						|
                // cases, namely:
 | 
						|
                //
 | 
						|
                // - Negative filter coefficients. The filters output signed
 | 
						|
                //   values, and it should be possible to end up with negative
 | 
						|
                //   output values.
 | 
						|
                //
 | 
						|
                // - Positive clipping. The hscale filter function has clipping
 | 
						|
                //   at (1<<15) - 1
 | 
						|
                //
 | 
						|
                // The coefficients sum to the 1.0 point for the hscale
 | 
						|
                // functions (1 << 14).
 | 
						|
 | 
						|
                for (j = 0; j < width; j++) {
 | 
						|
                    filter[i * width + j] = -((1 << 14) / (width - 1));
 | 
						|
                }
 | 
						|
                filter[i * width + (rnd() % width)] = ((1 << 15) - 1);
 | 
						|
            }
 | 
						|
 | 
						|
            for (i = 0; i < MAX_FILTER_WIDTH; i++) {
 | 
						|
                // These values should be unused in SIMD implementations but
 | 
						|
                // may still be read, random coefficients here should help show
 | 
						|
                // issues where they are used in error.
 | 
						|
 | 
						|
                filter[SRC_PIXELS * width + i] = rnd();
 | 
						|
            }
 | 
						|
            ff_getSwsFunc(ctx);
 | 
						|
 | 
						|
            if (check_func(ctx->hcScale, "hscale_%d_to_%d_width%d", ctx->srcBpc, ctx->dstBpc + 1, width)) {
 | 
						|
                memset(dst0, 0, SRC_PIXELS * sizeof(dst0[0]));
 | 
						|
                memset(dst1, 0, SRC_PIXELS * sizeof(dst1[0]));
 | 
						|
 | 
						|
                call_ref(NULL, dst0, SRC_PIXELS, src, filter, filterPos, width);
 | 
						|
                call_new(NULL, dst1, SRC_PIXELS, src, filter, filterPos, width);
 | 
						|
                if (memcmp(dst0, dst1, SRC_PIXELS * sizeof(dst0[0])))
 | 
						|
                    fail();
 | 
						|
                bench_new(NULL, dst0, SRC_PIXELS, src, filter, filterPos, width);
 | 
						|
            }
 | 
						|
        }
 | 
						|
    }
 | 
						|
    sws_freeContext(ctx);
 | 
						|
}
 | 
						|
 | 
						|
void checkasm_check_sw_scale(void)
 | 
						|
{
 | 
						|
    check_hscale();
 | 
						|
    report("hscale");
 | 
						|
}
 |