From 36bf66d4eb855fdc8945006d80e2896a325ba72e Mon Sep 17 00:00:00 2001 From: AiChaosN Date: Thu, 19 Jun 2025 10:22:34 +0800 Subject: [PATCH 1/2] checkPoint Change-Id: I9751c476d81aa825d4a9410ddfbcbed4463aafcc Signed-off-by: AiChaosN --- .../innerkitsimpl/utils/src/image_utils.cpp | 6 ++++++ .../image/libextplugin/src/ext_decoder.cpp | 21 ++++++++++++++++++- 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/frameworks/innerkitsimpl/utils/src/image_utils.cpp b/frameworks/innerkitsimpl/utils/src/image_utils.cpp index 4ca3a509b..e856ce7d7 100644 --- a/frameworks/innerkitsimpl/utils/src/image_utils.cpp +++ b/frameworks/innerkitsimpl/utils/src/image_utils.cpp @@ -472,20 +472,26 @@ bool ImageUtils::CheckMulOverflow(int32_t width, int32_t bytesPerPixel) bool ImageUtils::CheckMulOverflow(int32_t width, int32_t height, int32_t bytesPerPixel) { + IMAGE_LOGE("chaos CheckMulOverflow 01"); if (width == 0 || height == 0 || bytesPerPixel == 0) { + IMAGE_LOGE("chaos CheckMulOverflow 02"); IMAGE_LOGE("param is 0"); return true; } + IMAGE_LOGE("chaos CheckMulOverflow 03"); int32_t rectSize = width * height; if ((rectSize / width) != height) { + IMAGE_LOGE("chaos CheckMulOverflow 04"); IMAGE_LOGE("width * height overflow!"); return true; } int32_t bufferSize = rectSize * bytesPerPixel; if ((bufferSize / bytesPerPixel) != rectSize) { + IMAGE_LOGE("chaos CheckMulOverflow 05"); IMAGE_LOGE("bytesPerPixel overflow!"); return true; } + IMAGE_LOGE("chaos CheckMulOverflow 06"); return false; } diff --git a/plugins/common/libs/image/libextplugin/src/ext_decoder.cpp b/plugins/common/libs/image/libextplugin/src/ext_decoder.cpp index 7c9079b5e..f4f1a7a9d 100644 --- a/plugins/common/libs/image/libextplugin/src/ext_decoder.cpp +++ b/plugins/common/libs/image/libextplugin/src/ext_decoder.cpp @@ -647,16 +647,24 @@ static inline bool IsLowDownScale(const Size &size, SkImageInfo &info) static inline bool IsValidCrop(const OHOS::Media::Rect &crop, SkImageInfo &info, SkIRect &out) { + IMAGE_LOGE("chaos IsValidCrop 01"); out = SkIRect::MakeXYWH(crop.left, crop.top, crop.width, crop.height); + IMAGE_LOGE("chaos IsValidCrop 02"); if (out.fLeft < ZERO || out.fTop < ZERO) { + IMAGE_LOGE("chaos IsValidCrop 03"); return false; } + IMAGE_LOGE("chaos IsValidCrop 04"); if (out.fRight > info.width()) { + IMAGE_LOGE("chaos IsValidCrop 05"); out.fRight = info.width(); } + IMAGE_LOGE("chaos IsValidCrop 06"); if (out.fBottom > info.height()) { + IMAGE_LOGE("chaos IsValidCrop 07"); out.fBottom = info.height(); } + IMAGE_LOGE("chaos IsValidCrop 08"); return true; } @@ -670,25 +678,36 @@ static sk_sp getDesiredColorSpace(SkImageInfo &srcInfo, const Pixe uint32_t ExtDecoder::CheckDecodeOptions(uint32_t index, const PixelDecodeOptions &opts) { + IMAGE_LOGE("chaos 01"); if (ImageUtils::CheckMulOverflow(dstInfo_.width(), dstInfo_.height(), dstInfo_.bytesPerPixel())) { + IMAGE_LOGE("chaos 02"); return ERR_IMAGE_INVALID_PARAMETER; } + IMAGE_LOGE("chaos 03"); IMAGE_LOGD("%{public}s IN, opts.CropRect: xy [%{public}d x %{public}d] wh [%{public}d x %{public}d]", __func__, opts.CropRect.left, opts.CropRect.top, opts.CropRect.width, opts.CropRect.height); if (!IsValidCrop(opts.CropRect, info_, dstSubset_)) { + IMAGE_LOGE("chaos 04"); IMAGE_LOGE("Invalid crop rect top:%{public}d, bottom:%{public}d, left:%{public}d, right:%{public}d", dstSubset_.top(), dstSubset_.bottom(), dstSubset_.left(), dstSubset_.right()); + IMAGE_LOGE("chaos 05"); return ERR_IMAGE_INVALID_PARAMETER; } + IMAGE_LOGE("chaos 06"); IMAGE_LOGD("%{public}s IN, dstSubset_: xy [%{public}d x %{public}d] wh [%{public}d x %{public}d]", __func__, dstSubset_.left(), dstSubset_.top(), dstSubset_.width(), dstSubset_.height()); + IMAGE_LOGE("chaos 07"); size_t tempSrcByteCount = info_.computeMinByteSize(); + IMAGE_LOGE("chaos 08"); size_t tempDstByteCount = dstInfo_.computeMinByteSize(); + IMAGE_LOGE("chaos 09"); if (SkImageInfo::ByteSizeOverflowed(tempSrcByteCount) || SkImageInfo::ByteSizeOverflowed(tempDstByteCount)) { + IMAGE_LOGE("chaos 10"); return ERR_IMAGE_TOO_LARGE; } - + IMAGE_LOGE("chaos 11"); dstOptions_.fFrameIndex = static_cast(index); + IMAGE_LOGE("chaos 12"); #ifdef IMAGE_COLORSPACE_FLAG dstColorSpace_ = opts.plDesiredColorSpace; #endif -- Gitee From 458a74ceca6fc738164df144f62eb74bcb1d12ce Mon Sep 17 00:00:00 2001 From: AiChaosN Date: Thu, 19 Jun 2025 16:19:50 +0800 Subject: [PATCH 2/2] ok Change-Id: I3e4854e454677800730d6a4e86595926637e636a Signed-off-by: AiChaosN --- plugins/common/libs/image/libextplugin/src/ext_decoder.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/plugins/common/libs/image/libextplugin/src/ext_decoder.cpp b/plugins/common/libs/image/libextplugin/src/ext_decoder.cpp index f4f1a7a9d..c899e269b 100644 --- a/plugins/common/libs/image/libextplugin/src/ext_decoder.cpp +++ b/plugins/common/libs/image/libextplugin/src/ext_decoder.cpp @@ -686,6 +686,7 @@ uint32_t ExtDecoder::CheckDecodeOptions(uint32_t index, const PixelDecodeOptions IMAGE_LOGE("chaos 03"); IMAGE_LOGD("%{public}s IN, opts.CropRect: xy [%{public}d x %{public}d] wh [%{public}d x %{public}d]", __func__, opts.CropRect.left, opts.CropRect.top, opts.CropRect.width, opts.CropRect.height); + IMAGE_LOGE("chaos 03-1"); if (!IsValidCrop(opts.CropRect, info_, dstSubset_)) { IMAGE_LOGE("chaos 04"); IMAGE_LOGE("Invalid crop rect top:%{public}d, bottom:%{public}d, left:%{public}d, right:%{public}d", @@ -694,8 +695,8 @@ uint32_t ExtDecoder::CheckDecodeOptions(uint32_t index, const PixelDecodeOptions return ERR_IMAGE_INVALID_PARAMETER; } IMAGE_LOGE("chaos 06"); - IMAGE_LOGD("%{public}s IN, dstSubset_: xy [%{public}d x %{public}d] wh [%{public}d x %{public}d]", - __func__, dstSubset_.left(), dstSubset_.top(), dstSubset_.width(), dstSubset_.height()); + // IMAGE_LOGD("%{public}s IN, dstSubset_: xy [%{public}d x %{public}d] wh [%{public}d x %{public}d]", + // __func__, dstSubset_.left(), dstSubset_.top(), dstSubset_.width(), dstSubset_.height()); IMAGE_LOGE("chaos 07"); size_t tempSrcByteCount = info_.computeMinByteSize(); IMAGE_LOGE("chaos 08"); -- Gitee