ryujinx/SDL
1
0
Fork 0
mirror of https://github.com/Ryujinx/SDL.git synced 2025-03-23 22:15:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bug #4841 - Out of bounds read (by 1 byte) in yuvnv12_rgb24_sseu

Browse source
This commit is contained in:
Sylvain 2021-10-17 22:02:19 +02:00
parent ea97ab6164
commit 50f969c1b2
No known key found for this signature in database
GPG key ID: 5F87E02E5BC0939E
1 changed files with 15 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
src/video/yuv2rgb/yuv_rgb_sse_func.h
View file

@ -415,6 +415,17 @@ void SSE_FUNCTION_NAME(uint32_t width, uint32_t height,
#error Unknown RGB pixel size #error Unknown RGB pixel size
#endif #endif
#if YUV_FORMAT == YUV_FORMAT_NV12
/* For NV12 formats (where U/V are interleaved)
* SSE READ_UV does an invalid read access at the very last pixel.
* As a workaround. Make sure not to decode the last column using assembly but with STD fallback path.
* see https://github.com/libsdl-org/SDL/issues/4841
*/
const int fix_read_nv12 = ((width & 31) == 0);
#else
const int fix_read_nv12 = 0;
#endif
if (width >= 32) { if (width >= 32) {
uint32_t xpos, ypos; uint32_t xpos, ypos;
for(ypos=0; ypos<(height-(uv_y_sample_interval-1)); ypos+=uv_y_sample_interval) for(ypos=0; ypos<(height-(uv_y_sample_interval-1)); ypos+=uv_y_sample_interval)
@ -427,7 +438,7 @@ void SSE_FUNCTION_NAME(uint32_t width, uint32_t height,
uint8_t *rgb_ptr1=RGB+ypos*RGB_stride, uint8_t *rgb_ptr1=RGB+ypos*RGB_stride,
*rgb_ptr2=RGB+(ypos+1)*RGB_stride; *rgb_ptr2=RGB+(ypos+1)*RGB_stride;
for(xpos=0; xpos<(width-31); xpos+=32) for(xpos=0; xpos<(width-31) - fix_read_nv12; xpos+=32)
{ {
YUV2RGB_32 YUV2RGB_32
{ {
@ -464,6 +475,9 @@ void SSE_FUNCTION_NAME(uint32_t width, uint32_t height,
/* Catch the right column, if needed */ /* Catch the right column, if needed */
{ {
int converted = (width & ~31); int converted = (width & ~31);
if (fix_read_nv12) {
converted -= 32;
}
if (converted != width) if (converted != width)
{ {
const uint8_t *y_ptr=Y+converted*y_pixel_stride, const uint8_t *y_ptr=Y+converted*y_pixel_stride,