From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.ffmpeg.org (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTPS id 0E5024D1A6 for ; Wed, 12 Nov 2025 03:13:05 +0000 (UTC) Authentication-Results: ffbox; dkim=fail (body hash mismatch (got b'1k3oKPxi3eS+WRNfY9VOVjObUFaJihkQuBTJPY/ppaM=', expected b'9auqHQjvH2iln9dkzWkk8NtIr1nKGSXYWWniIS49Ojk=')) header.d=ffmpeg.org header.i=@ffmpeg.org header.a=rsa-sha256 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1762917178; h=mime-version : to : date : message-id : reply-to : subject : list-id : list-archive : list-archive : list-help : list-owner : list-post : list-subscribe : list-unsubscribe : from : cc : content-type : content-transfer-encoding : from; bh=1k3oKPxi3eS+WRNfY9VOVjObUFaJihkQuBTJPY/ppaM=; b=Uocs4guch/gxOqzE6lrLe0TB9TGhhqmgCWYKSv6wQkrN9H+rl3JI4zXc2Xj8rKYUroEfU yvzwTVtnOULdj3sQfm1fn+hxRvAgSt0qw3SonSvpoNqjy/WJ8YsAbwqQYCewEzxO9JmdN7d 3VXm/4wjH+QXNHONp41ixVBX7V7qiehrRnh8aGPk694ZaxXFHwh+L2H2Nws43jBw4C245sH q6M5FnoRMCKXIkJHT1GdD9lFyaea6jXIfPAJodk1rH5RK25VM6cCrvttrZVnNE3i3jU9d1n b2+E4J9FJ7xsCTRca0lNZoAbz8Shy+2XR3xHQ9v9J9jkTMGD5XQ0GGKIayWw== Received: from [172.19.0.2] (unknown [172.19.0.2]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTP id 7514268FD34; Wed, 12 Nov 2025 05:12:58 +0200 (EET) ARC-Seal: i=1; cv=none; a=rsa-sha256; d=ffmpeg.org; s=arc; t=1762917162; b=rbbpxfptsVbJt3JZ1tZAqsIJSqzZcEgptz/fS3zpCc13fTl5XEM6Ny9abTMvA/Mh+xdm+ 92NVZk79sRpEnfJBu8PJ4S8tcDGTIUYuJgeBw1yCWoqCmhdL4IvN1+TXkQ1ov2+4lcOuZpN IPfJKIXhJcCCutNuRJSFClxBsA7UOISj9kPAgl4Xj6nC03VkA67lOahxp845x37s5oxU5Sh Ae3iKr6+s0O/+3j11N4ht934AAX4tWUJyFDrGDDiiVk2JpZO9Ht1IgDRpVdEMqpu4H/Leh1 9VUOH95PtXazIZZpcZg0jhm+Kphp1X2VhOvf+ZHdw/y9R3q0SUYFhb+71yRw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=ffmpeg.org; s=arc; t=1762917162; h=from : sender : reply-to : subject : date : message-id : to : cc : mime-version : content-type : content-transfer-encoding : content-id : content-description : resent-date : resent-from : resent-sender : resent-to : resent-cc : resent-message-id : in-reply-to : references : list-id : list-help : list-unsubscribe : list-subscribe : list-post : list-owner : list-archive; bh=S7VFZXQpeilRDAJNYNmfYFNZdie6E1zDQtJzKNtG1d0=; b=NIlmT3O4yEj0da7JL2jIVa2IPBmNPQGLKbfDX5+P/s/MoFI6A0chQrTRUd23DO8uzKY7X M3AfvJAAoFC2L5hF6zZsa7iNLZmCP74vZ3K2TYWAfkgV3IJDoOZjWx7e4kC/wPGK+4ig65h NPmhOfH8q9tCerxjWWd0iln5H+d0y92t6NmdDSEGsUFvnUP6CS1Scx+gccvMElXA97kYBzc /SeIimow7nooGpq5vgP6bGGgB9EEJ/YlFf2/kqHQK2wa0sPA75C8vflTq9gNI1ztUA6sMNZ +bK7T+b5Z74dXIwdnUFXzW4h/aqf+5EWty0v3JxXggXSo6XGMTRDPxqO/dPQ== ARC-Authentication-Results: i=1; ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none; dmarc=pass header.from=ffmpeg.org policy.dmarc=quarantine Authentication-Results: ffmpeg.org; dkim=pass header.d=ffmpeg.org header.i=@ffmpeg.org; arc=none (Message is not ARC signed); dmarc=pass (Used From Domain Record) header.from=ffmpeg.org policy.dmarc=quarantine DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ffmpeg.org; i=@ffmpeg.org; q=dns/txt; s=mail; t=1762917155; h=content-type : mime-version : content-transfer-encoding : from : to : reply-to : subject : date : from; bh=9auqHQjvH2iln9dkzWkk8NtIr1nKGSXYWWniIS49Ojk=; b=gZIsHV16RTNP6ZNbbek2ToQQNIk8pEIBUIfFVsC9onvCedL6sbFKAHwuLOxkjLCbsVdup nTX53cs4XdqoGf9L43DYdrNpWSkkcSYD8GcERouNijvKGBETgum091jbrH9PJL9hsVnug0/ Krq7Bhlh/PuysZDFIrIHixVj9jwgQm5EGzRAQDLtu3rA8szq86wVCKtJ3nnMfZV2eBaFTWB J16gforNABqD13MCaCfdBxSR1YARos95iD7gPkWn5Ha4LKBmr3y49xvXbD/4Dfar4JZaWgI dFBa+Kh+8rw/vCggo0cGHjFOfk6Y4NECMc7nk/arHWWbYFh7YhMCzQvWaBQg== Received: from 188d6d40ca7a (code.ffmpeg.org [188.245.149.3]) by ffbox0-bg.ffmpeg.org (Postfix) with ESMTPS id 85CBA68FC07 for ; Wed, 12 Nov 2025 05:12:35 +0200 (EET) MIME-Version: 1.0 To: ffmpeg-devel@ffmpeg.org Date: Wed, 12 Nov 2025 03:12:35 -0000 Message-ID: <176291715569.25.14557720379356939594@2cb04c0e5124> Message-ID-Hash: L5VX5BQLA26TSSIZS6BJG5Y3LN3XXKGY X-Message-ID-Hash: L5VX5BQLA26TSSIZS6BJG5Y3LN3XXKGY X-MailFrom: code@ffmpeg.org X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-ffmpeg-devel.ffmpeg.org-0; header-match-ffmpeg-devel.ffmpeg.org-1; header-match-ffmpeg-devel.ffmpeg.org-2; header-match-ffmpeg-devel.ffmpeg.org-3; emergency; member-moderation X-Mailman-Version: 3.3.10 Precedence: list Reply-To: FFmpeg development discussions and patches Subject: [FFmpeg-devel] [PATCH] swscale: Fix out-of-bounds write errors in yuv2rgb_lasx.c file. (PR #20895) List-Id: FFmpeg development discussions and patches Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: chenhao via ffmpeg-devel Cc: chenhao Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Archived-At: List-Archive: List-Post: PR #20895 opened by chenhao URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20895 Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20895.patch In the YUV420 format, a single pair of UV values produces two RGB pixels. Because of this, cases with an odd dstw value do not need to be considered. The patch adds support for dstw values ending in 2, 4, 6, 8, 10, 12, and 14, which fixes the out-of-bounds write problem. >>From 981b466bebf5668d61da24511b459fb068194ad5 Mon Sep 17 00:00:00 2001 From: Hao Chen Date: Tue, 11 Nov 2025 19:05:48 +0800 Subject: [PATCH] swscale: Fix out-of-bounds write errors in yuv2rgb_lasx.c file. --- libswscale/loongarch/yuv2rgb_lasx.c | 108 ++++++++++++++++++++++++---- 1 file changed, 96 insertions(+), 12 deletions(-) diff --git a/libswscale/loongarch/yuv2rgb_lasx.c b/libswscale/loongarch/yuv2rgb_lasx.c index d83e5d70fe..9032887ff8 100644 --- a/libswscale/loongarch/yuv2rgb_lasx.c +++ b/libswscale/loongarch/yuv2rgb_lasx.c @@ -173,7 +173,7 @@ __m256i shuf3 = {0x1E0F0E1C0D0C1A0B, 0x0101010101010101, \ 0x1E0F0E1C0D0C1A0B, 0x0101010101010101}; \ YUV2RGB_LOAD_COE \ - y = (c->opts.dst_w + 7) & ~7; \ + y = c->opts.dst_w; \ h_size = y >> 4; \ res = y & 15; \ \ @@ -199,7 +199,7 @@ __m256i a = __lasx_xvldi(0xFF); \ \ YUV2RGB_LOAD_COE \ - y = (c->opts.dst_w + 7) & ~7; \ + y = c->opts.dst_w; \ h_size = y >> 4; \ res = y & 15; \ \ @@ -215,7 +215,7 @@ const uint8_t *pv = src[2] + (y >> vshift) * srcStride[2]; \ for(x = 0; x < h_size; x++) { \ -#define DEALYUV2RGBREMAIN \ +#define DEALYUV2RGBLINE \ py_1 += 16; \ py_2 += 16; \ pu += 8; \ @@ -223,9 +223,40 @@ image1 += 48; \ image2 += 48; \ } \ - if (res) { \ + if (res & 8) { \ -#define DEALYUV2RGBREMAIN32 \ +#define DEALYUV2RGBLINERES \ + py_1 += 8; \ + py_2 += 8; \ + pu += 4; \ + pv += 4; \ + image1 += 24; \ + image2 += 24; \ + res -= 8 ; \ + } \ + if (res) { + +#define ENDYUV2RGBLINE(rgb_l, rgb_h, image_1, image_2) \ + if (res == 6) { \ + __lasx_xvstelm_d(rgb_l, image_1, 0, 0); \ + __lasx_xvstelm_d(rgb_l, image_1, 8, 1); \ + __lasx_xvstelm_h(rgb_h, image_1, 16, 0); \ + __lasx_xvstelm_d(rgb_l, image_2, 0, 2); \ + __lasx_xvstelm_d(rgb_l, image_2, 8, 3); \ + __lasx_xvstelm_h(rgb_h, image_2, 16, 8); \ + } else if (res == 4) { \ + __lasx_xvstelm_d(rgb_l, image_1, 0, 0); \ + __lasx_xvstelm_w(rgb_l, image_1, 8, 2); \ + __lasx_xvstelm_d(rgb_l, image_2, 0, 2); \ + __lasx_xvstelm_w(rgb_l, image_2, 8, 6); \ + } else if (res == 2) { \ + __lasx_xvstelm_w(rgb_l, image_1, 0, 0); \ + __lasx_xvstelm_h(rgb_l, image_1, 4, 2); \ + __lasx_xvstelm_w(rgb_l, image_2, 0, 4); \ + __lasx_xvstelm_h(rgb_l, image_2, 4, 10); \ + } + +#define DEALYUV2RGBLINE32 \ py_1 += 16; \ py_2 += 16; \ pu += 8; \ @@ -233,7 +264,36 @@ image1 += 16; \ image2 += 16; \ } \ - if (res) { \ + if (res & 8) { \ + +#define DEALYUV2RGBLINERES32 \ + py_1 += 8; \ + py_2 += 8; \ + pu += 4; \ + pv += 4; \ + image1 += 8; \ + image2 += 8; \ + res -= 8; \ + } \ + if (res) { + +#define ENDYUV2RGBLINE32(rgb_l, rgb_h, image_1, image_2) \ + if (res == 6) { \ + __lasx_xvstelm_d(rgb_l, image_1, 0, 0); \ + __lasx_xvstelm_d(rgb_l, image_1, 8, 1); \ + __lasx_xvstelm_d(rgb_l, image_1, 16, 2); \ + __lasx_xvstelm_d(rgb_h, image_2, 0, 0); \ + __lasx_xvstelm_d(rgb_h, image_2, 8, 1); \ + __lasx_xvstelm_d(rgb_h, image_2, 16, 2); \ + } else if (res == 4) { \ + __lasx_xvstelm_d(rgb_l, image_1, 0, 0); \ + __lasx_xvstelm_d(rgb_l, image_1, 8, 1); \ + __lasx_xvstelm_d(rgb_h, image_2, 0, 0); \ + __lasx_xvstelm_d(rgb_h, image_2, 8, 1); \ + } else if (res == 2) { \ + __lasx_xvstelm_d(rgb_l, image_1, 0, 0); \ + __lasx_xvstelm_d(rgb_h, image_2, 0, 0); \ + } #define END_FUNC() \ @@ -249,10 +309,14 @@ YUV2RGBFUNC(yuv420_rgb24_lasx, uint8_t, 0) RGB_PACK(r2, g2, b2, rgb2_l, rgb2_h); RGB_STORE(rgb1_l, rgb1_h, image1); RGB_STORE(rgb2_l, rgb2_h, image2); - DEALYUV2RGBREMAIN + DEALYUV2RGBLINE YUV2RGB_RES RGB_PACK(r1, g1, b1, rgb1_l, rgb1_h); RGB_STORE_RES(rgb1_l, rgb1_h, image1, image2); + DEALYUV2RGBLINERES + YUV2RGB_RES + RGB_PACK(r1, g1, b1, rgb1_l, rgb1_h); + ENDYUV2RGBLINE(rgb1_l, rgb1_h, image1, image2); END_FUNC() YUV2RGBFUNC(yuv420_bgr24_lasx, uint8_t, 0) @@ -262,10 +326,14 @@ YUV2RGBFUNC(yuv420_bgr24_lasx, uint8_t, 0) RGB_PACK(b2, g2, r2, rgb2_l, rgb2_h); RGB_STORE(rgb1_l, rgb1_h, image1); RGB_STORE(rgb2_l, rgb2_h, image2); - DEALYUV2RGBREMAIN + DEALYUV2RGBLINE YUV2RGB_RES RGB_PACK(b1, g1, r1, rgb1_l, rgb1_h); RGB_STORE_RES(rgb1_l, rgb1_h, image1, image2); + DEALYUV2RGBLINERES + YUV2RGB_RES + RGB_PACK(b1, g1, r1, rgb1_l, rgb1_h); + ENDYUV2RGBLINE(rgb1_l, rgb1_h, image1, image2); END_FUNC() YUV2RGBFUNC32(yuv420_rgba32_lasx, uint32_t, 0) @@ -275,10 +343,14 @@ YUV2RGBFUNC32(yuv420_rgba32_lasx, uint32_t, 0) RGB32_PACK(r2, g2, b2, a, rgb2_l, rgb2_h); RGB32_STORE(rgb1_l, rgb1_h, image1); RGB32_STORE(rgb2_l, rgb2_h, image2); - DEALYUV2RGBREMAIN32 + DEALYUV2RGBLINE32 YUV2RGB_RES RGB32_PACK(r1, g1, b1, a, rgb1_l, rgb1_h); RGB32_STORE_RES(rgb1_l, rgb1_h, image1, image2); + DEALYUV2RGBLINERES32 + YUV2RGB_RES + RGB32_PACK(r1, g1, b1, a, rgb1_l, rgb1_h); + ENDYUV2RGBLINE32(rgb1_l, rgb1_h, image1, image2); END_FUNC() YUV2RGBFUNC32(yuv420_bgra32_lasx, uint32_t, 0) @@ -288,10 +360,14 @@ YUV2RGBFUNC32(yuv420_bgra32_lasx, uint32_t, 0) RGB32_PACK(b2, g2, r2, a, rgb2_l, rgb2_h); RGB32_STORE(rgb1_l, rgb1_h, image1); RGB32_STORE(rgb2_l, rgb2_h, image2); - DEALYUV2RGBREMAIN32 + DEALYUV2RGBLINE32 YUV2RGB_RES RGB32_PACK(b1, g1, r1, a, rgb1_l, rgb1_h); RGB32_STORE_RES(rgb1_l, rgb1_h, image1, image2); + DEALYUV2RGBLINERES32 + YUV2RGB_RES + RGB32_PACK(b1, g1, r1, a, rgb1_l, rgb1_h); + ENDYUV2RGBLINE32(rgb1_l, rgb1_h, image1, image2); END_FUNC() YUV2RGBFUNC32(yuv420_argb32_lasx, uint32_t, 0) @@ -301,10 +377,14 @@ YUV2RGBFUNC32(yuv420_argb32_lasx, uint32_t, 0) RGB32_PACK(a, r2, g2, b2, rgb2_l, rgb2_h); RGB32_STORE(rgb1_l, rgb1_h, image1); RGB32_STORE(rgb2_l, rgb2_h, image2); - DEALYUV2RGBREMAIN32 + DEALYUV2RGBLINE32 YUV2RGB_RES RGB32_PACK(a, r1, g1, b1, rgb1_l, rgb1_h); RGB32_STORE_RES(rgb1_l, rgb1_h, image1, image2); + DEALYUV2RGBLINERES32 + YUV2RGB_RES + RGB32_PACK(a, r1, g1, b1, rgb1_l, rgb1_h); + ENDYUV2RGBLINE32(rgb1_l, rgb1_h, image1, image2); END_FUNC() YUV2RGBFUNC32(yuv420_abgr32_lasx, uint32_t, 0) @@ -314,8 +394,12 @@ YUV2RGBFUNC32(yuv420_abgr32_lasx, uint32_t, 0) RGB32_PACK(a, b2, g2, r2, rgb2_l, rgb2_h); RGB32_STORE(rgb1_l, rgb1_h, image1); RGB32_STORE(rgb2_l, rgb2_h, image2); - DEALYUV2RGBREMAIN32 + DEALYUV2RGBLINE32 YUV2RGB_RES RGB32_PACK(a, b1, g1, r1, rgb1_l, rgb1_h); RGB32_STORE_RES(rgb1_l, rgb1_h, image1, image2); + DEALYUV2RGBLINERES32 + YUV2RGB_RES + RGB32_PACK(a, b1, g1, r1, rgb1_l, rgb1_h); + ENDYUV2RGBLINE32(rgb1_l, rgb1_h, image1, image2); END_FUNC() -- 2.49.1 _______________________________________________ ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org