[vlc-commits] [Git][videolan/vlc][3.0.x] 2 commits: codec: omxil: check GetVlcChromaSizes return
Steve Lhomme (@robUx4)
gitlab at videolan.org
Thu Aug 27 13:49:34 UTC 2026
Steve Lhomme pushed to branch 3.0.x at VideoLAN / VLC
Commits:
3f6aad05 by François Cartegnie at 2026-08-27T13:37:27+00:00
codec: omxil: check GetVlcChromaSizes return
(adapted picked from commit 520afe45625c8328f2da70f56dcbd372d9cecdd2)
- - - - -
0f6ca04a by François Cartegnie at 2026-08-27T13:37:27+00:00
codec: omxil: check for overflow
fix #29720
(revised from commit 41db420818b2fd0a9e29449bbf2130ea33cbc404)
- - - - -
3 changed files:
- modules/codec/omxil/mediacodec.c
- modules/codec/omxil/omxil.c
- modules/codec/omxil/utils.c
Changes:
=====================================
modules/codec/omxil/mediacodec.c
=====================================
@@ -1007,10 +1007,15 @@ static int Video_ProcessOutput(decoder_t *p_dec, mc_api_out *p_out,
InsertInflightPicture(p_dec, p_pic->p_sys);
} else {
unsigned int chroma_div;
- GetVlcChromaSizes(p_dec->fmt_out.i_codec,
+ if( !GetVlcChromaSizes(p_dec->fmt_out.i_codec,
p_dec->fmt_out.video.i_width,
p_dec->fmt_out.video.i_height,
- NULL, NULL, &chroma_div);
+ NULL, NULL, &chroma_div) )
+ {
+ p_sys->api.release_out(&p_sys->api, p_out->buf.i_index, false);
+ picture_Release(p_pic);
+ return -1;
+ }
CopyOmxPicture(p_sys->video.i_pixel_format, p_pic,
p_sys->video.i_slice_height, p_sys->video.i_stride,
(uint8_t *)p_out->buf.p_ptr, chroma_div, NULL);
=====================================
modules/codec/omxil/omxil.c
=====================================
@@ -208,11 +208,12 @@ static OMX_ERRORTYPE ImplementationSpecificWorkarounds(decoder_t *p_dec,
def->format.video.eColorFormat = OMX_COLOR_FormatCbYCrY;
GetVlcChromaFormat( def->format.video.eColorFormat,
&p_fmt->i_codec, 0 );
- GetVlcChromaSizes( p_fmt->i_codec,
+ if( !GetVlcChromaSizes( p_fmt->i_codec,
def->format.video.nFrameWidth,
def->format.video.nFrameHeight,
&p_port->i_frame_size, &p_port->i_frame_stride,
- &p_port->i_frame_stride_chroma_div );
+ &p_port->i_frame_stride_chroma_div ))
+ return OMX_ErrorBadParameter;
def->format.video.nStride = p_port->i_frame_stride;
def->nBufferSize = p_port->i_frame_size;
}
@@ -293,11 +294,15 @@ static OMX_ERRORTYPE SetPortDefinition(decoder_t *p_dec, OmxPort *p_port,
CHECK_ERROR(omx_error, "codec %4.4s doesn't match any OMX format",
(char *)&p_fmt->i_codec );
}
- GetVlcChromaSizes( p_fmt->i_codec,
+ if( !GetVlcChromaSizes( p_fmt->i_codec,
def->format.video.nFrameWidth,
def->format.video.nFrameHeight,
&p_port->i_frame_size, &p_port->i_frame_stride,
- &p_port->i_frame_stride_chroma_div );
+ &p_port->i_frame_stride_chroma_div ) )
+ {
+ omx_error = OMX_ErrorBadParameter;
+ goto error;
+ }
def->format.video.nStride = p_port->i_frame_stride;
def->nBufferSize = p_port->i_frame_size;
}
@@ -317,11 +322,15 @@ static OMX_ERRORTYPE SetPortDefinition(decoder_t *p_dec, OmxPort *p_port,
CHECK_ERROR(omx_error, "OMX color format %i not supported",
(int)def->format.video.eColorFormat );
}
- GetVlcChromaSizes( p_fmt->i_codec,
+ if( !GetVlcChromaSizes( p_fmt->i_codec,
def->format.video.nFrameWidth,
def->format.video.nFrameHeight,
&p_port->i_frame_size, &p_port->i_frame_stride,
- &p_port->i_frame_stride_chroma_div );
+ &p_port->i_frame_stride_chroma_div ) )
+ {
+ omx_error = OMX_ErrorBadParameter;
+ goto error;
+ }
def->format.video.nStride = p_port->i_frame_stride;
if (p_port->i_frame_size > def->nBufferSize)
def->nBufferSize = p_port->i_frame_size;
@@ -660,11 +669,15 @@ static OMX_ERRORTYPE GetPortDefinition(decoder_t *p_dec, OmxPort *p_port,
CHECK_ERROR(omx_error, "OMX color format %i not supported",
(int)def->format.video.eColorFormat );
}
- GetVlcChromaSizes( p_fmt->i_codec,
+ if( !GetVlcChromaSizes( p_fmt->i_codec,
def->format.video.nFrameWidth,
def->format.video.nFrameHeight,
&p_port->i_frame_size, &p_port->i_frame_stride,
- &p_port->i_frame_stride_chroma_div );
+ &p_port->i_frame_stride_chroma_div ) )
+ {
+ omx_error = OMX_ErrorBadParameter;
+ goto error;
+ }
}
if(p_port->i_frame_size > def->nBufferSize)
def->nBufferSize = p_port->i_frame_size;
=====================================
modules/codec/omxil/utils.c
=====================================
@@ -39,6 +39,8 @@
#include "../../video_chroma/copy.h"
#include "../../packetizer/h264_nal.h"
+#include <stdckdint.h>
+
/*****************************************************************************
* Events utility functions
*****************************************************************************/
@@ -775,11 +777,24 @@ int GetVlcChromaSizes( vlc_fourcc_t i_fourcc,
if( chroma_format_table[i].i_fourcc == i_fourcc ) break;
/* Align on macroblock boundary */
- width = (width + 15) & ~0xF;
- height = (height + 15) & ~0xF;
+ if( ckd_add( &width, width, 15 ) ||
+ ckd_add( &height, height, 15 ) )
+ return 0;
+ width &= ~0xF;
+ height &= ~0xF;
- if( size ) *size = width * height * chroma_format_table[i].i_size_mul / 2;
- if( pitch ) *pitch = width * chroma_format_table[i].i_line_mul;
+ if( size )
+ {
+ if( ckd_mul( size, width, height ) ||
+ ckd_mul( size, *size, chroma_format_table[i].i_size_mul ) )
+ return 0;
+ *size /= 2;
+ }
+ if( pitch )
+ {
+ if( ckd_mul( pitch, width, chroma_format_table[i].i_line_mul ) )
+ return 0;
+ }
if( chroma_pitch_div )
*chroma_pitch_div = chroma_format_table[i].i_line_chroma_div;
return !!chroma_format_table[i].i_codec;
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/4e025de7529ca8b7068b3fe3a0f70ac77479f940...0f6ca04a63e44215a5f44681a5cdde3c5fc1e7a3
--
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/4e025de7529ca8b7068b3fe3a0f70ac77479f940...0f6ca04a63e44215a5f44681a5cdde3c5fc1e7a3
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help
More information about the vlc-commits
mailing list