From 9402f9275feb31d66a6354ef60c4244f0c552a91 Mon Sep 17 00:00:00 2001 From: fanzhihao8 Date: Tue, 12 Aug 2025 18:44:54 +0800 Subject: [PATCH 1/4] fix overflow for RGB_565 Signed-off-by: fanzhihao8 --- .../converter/src/pixel_convert.cpp | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/frameworks/innerkitsimpl/converter/src/pixel_convert.cpp b/frameworks/innerkitsimpl/converter/src/pixel_convert.cpp index 64e813c81..1d77aaac4 100644 --- a/frameworks/innerkitsimpl/converter/src/pixel_convert.cpp +++ b/frameworks/innerkitsimpl/converter/src/pixel_convert.cpp @@ -93,6 +93,7 @@ constexpr uint32_t BIT_SHIFT_16BITS = 16; constexpr uint32_t EVEN_ALIGNMENT = 2; constexpr int32_t CONVERT_ERROR = -1; constexpr uint32_t UV_PLANES_COUNT = 2; +constexpr uint8_t RGB565_EXTRA_BYTES = 2; static const std::map SWS_CS_COEFFICIENT = { {YuvConversion::BT601, SWS_CS_DEFAULT}, @@ -1338,6 +1339,30 @@ static bool P010ConvertRGBA1010102(const void *srcPixels, ImageInfo srcInfo, return true; } +static bool P010ConvertRGB565(const uint8_t* srcP010, const ImageInfo& srcInfo, + void* dstPixels, const ImageInfo& dstInfo) +{ + int64_t bufferSize = GetValidBufferSize(dstInfo); +IMAGE_LOGE("enter here P010ConvertRGB565, dst: format = %{public}d, bufferSize = %{public}u", dstInfo.pixelFormat, static_cast(bufferSize)); + if (bufferSize <= 0) { + return false; + } + std::unique_ptr tmpBuffer = std::make_unique(bufferSize + RGB565_EXTRA_BYTES); // avoid ffmpeg out-bounds-write + if (tmpBuffer == nullptr) { + IMAGE_LOGE("P010ConvertRGB565: alloc temp buffer failed"); + return false; + } + if (!ConvertForFFMPEG(srcP010, srcInfo.pixelFormat, srcInfo, tmpBuffer.get(), dstInfo.pixelFormat)) { + IMAGE_LOGE("P010ConvertRGB565: FFMpeg convert failed"); + return false; + } + if (memcpy_s(dstPixels, bufferSize, tmpBuffer.get(), bufferSize) != 0) { + IMAGE_LOGE("P010ConvertRGB565: memcpy_s dstPixels failed!"); + return false; + } + return true; +} + static bool ConvertRGBA1010102ToYUV(const void *srcPixels, ImageInfo srcInfo, void *dstPixels, ImageInfo dstInfo) { @@ -1485,6 +1510,11 @@ static int32_t ConvertFromP010(const void *srcPixels, const int32_t srcLength, c return PixelMap::GetRGBxByteCount(dstInfo); } return -1; + } else if (dstInfo.pixelFormat == PixelFormat::RGB_565) { + if (P010ConvertRGB565(srcP010, srcInfo, dstPixels, dstInfo)) { + return PixelMap::GetRGBxByteCount(dstInfo); + } + return -1; } else { if (ConvertForFFMPEG(srcP010, srcInfo.pixelFormat, srcInfo, dstPixels, dstInfo.pixelFormat)) { return PixelMap::GetRGBxByteCount(dstInfo); -- Gitee From 64d4d66dff6e528b732a12c42ee2c511e7347416 Mon Sep 17 00:00:00 2001 From: fanzhihao8 Date: Tue, 12 Aug 2025 18:47:07 +0800 Subject: [PATCH 2/4] fix overflow for RGB_565 Signed-off-by: fanzhihao8 --- frameworks/innerkitsimpl/converter/src/pixel_convert.cpp | 1 - 1 file changed, 1 deletion(-) diff --git a/frameworks/innerkitsimpl/converter/src/pixel_convert.cpp b/frameworks/innerkitsimpl/converter/src/pixel_convert.cpp index 1d77aaac4..e3996b84a 100644 --- a/frameworks/innerkitsimpl/converter/src/pixel_convert.cpp +++ b/frameworks/innerkitsimpl/converter/src/pixel_convert.cpp @@ -1343,7 +1343,6 @@ static bool P010ConvertRGB565(const uint8_t* srcP010, const ImageInfo& srcInfo, void* dstPixels, const ImageInfo& dstInfo) { int64_t bufferSize = GetValidBufferSize(dstInfo); -IMAGE_LOGE("enter here P010ConvertRGB565, dst: format = %{public}d, bufferSize = %{public}u", dstInfo.pixelFormat, static_cast(bufferSize)); if (bufferSize <= 0) { return false; } -- Gitee From 7d508255c60338ea0b6a65da7ad127fc61815eee Mon Sep 17 00:00:00 2001 From: fanzhihao8 Date: Tue, 12 Aug 2025 18:59:21 +0800 Subject: [PATCH 3/4] fix overflow for RGB_565 Signed-off-by: fanzhihao8 --- frameworks/innerkitsimpl/converter/src/pixel_convert.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/frameworks/innerkitsimpl/converter/src/pixel_convert.cpp b/frameworks/innerkitsimpl/converter/src/pixel_convert.cpp index e3996b84a..ed9a052f9 100644 --- a/frameworks/innerkitsimpl/converter/src/pixel_convert.cpp +++ b/frameworks/innerkitsimpl/converter/src/pixel_convert.cpp @@ -1339,14 +1339,15 @@ static bool P010ConvertRGBA1010102(const void *srcPixels, ImageInfo srcInfo, return true; } -static bool P010ConvertRGB565(const uint8_t* srcP010, const ImageInfo& srcInfo, +static bool P010ConvertRGB565(const uint8_t* srcP010, const ImageInfo& srcInfo, void* dstPixels, const ImageInfo& dstInfo) { int64_t bufferSize = GetValidBufferSize(dstInfo); if (bufferSize <= 0) { return false; } - std::unique_ptr tmpBuffer = std::make_unique(bufferSize + RGB565_EXTRA_BYTES); // avoid ffmpeg out-bounds-write + std::unique_ptr tmpBuffer = nullptr; + tmpBuffer = std::make_unique(bufferSize + RGB565_EXTRA_BYTES); // avoid ffmpeg out-bounds-write if (tmpBuffer == nullptr) { IMAGE_LOGE("P010ConvertRGB565: alloc temp buffer failed"); return false; -- Gitee From 48996b27bcd55fc060b79101397e6c3a1d508932 Mon Sep 17 00:00:00 2001 From: fanzhihao8 Date: Tue, 12 Aug 2025 22:19:42 +0800 Subject: [PATCH 4/4] fix overflow for RGB_565 Signed-off-by: fanzhihao8 --- .../converter/src/pixel_convert.cpp | 5 +++-- .../unittest/image_format_convert_test.cpp | 22 +++++++++++++++++++ 2 files changed, 25 insertions(+), 2 deletions(-) diff --git a/frameworks/innerkitsimpl/converter/src/pixel_convert.cpp b/frameworks/innerkitsimpl/converter/src/pixel_convert.cpp index ed9a052f9..922acf270 100644 --- a/frameworks/innerkitsimpl/converter/src/pixel_convert.cpp +++ b/frameworks/innerkitsimpl/converter/src/pixel_convert.cpp @@ -1346,8 +1346,9 @@ static bool P010ConvertRGB565(const uint8_t* srcP010, const ImageInfo& srcInfo, if (bufferSize <= 0) { return false; } - std::unique_ptr tmpBuffer = nullptr; - tmpBuffer = std::make_unique(bufferSize + RGB565_EXTRA_BYTES); // avoid ffmpeg out-bounds-write + + std::unique_ptr tmpBuffer = + std::make_unique(bufferSize + RGB565_EXTRA_BYTES); // avoid ffmpeg out-bounds-write if (tmpBuffer == nullptr) { IMAGE_LOGE("P010ConvertRGB565: alloc temp buffer failed"); return false; diff --git a/frameworks/innerkitsimpl/test/unittest/image_format_convert_test.cpp b/frameworks/innerkitsimpl/test/unittest/image_format_convert_test.cpp index 6de636f3b..affe02cfa 100644 --- a/frameworks/innerkitsimpl/test/unittest/image_format_convert_test.cpp +++ b/frameworks/innerkitsimpl/test/unittest/image_format_convert_test.cpp @@ -2214,6 +2214,28 @@ HWTEST_F(ImageFormatConvertTest, PixelMapFormatConvert_032, TestSize.Level3) GTEST_LOG_(INFO) << "ImageFormatConvertTest.PixelMapFormatConvert_032: end"; } +HWTEST_F(ImageFormatConvertTest, PixelMapFormatConvert_033, TestSize.Level3) +{ + GTEST_LOG_(INFO) << "ImageFormatConvertTest: PixelMapFormatConvert_033: start"; + PixelFormat srcFormat = PixelFormat::YCRCB_P010; + PixelFormat destFormat = PixelFormat::RGB_565; + Size srcSize = { ODDTREE_ORIGINAL_WIDTH, ODDTREE_ORIGINAL_HEIGHT }; + uint32_t destBuffersize = srcSize.width * srcSize.height * BYTES_PER_PIXEL_RGB565; + PixelMap10bitConvert(srcFormat, destFormat, srcSize, destBuffersize); + GTEST_LOG_(INFO) << "ImageFormatConvertTest: PixelMapFormatConvert_033: end"; +} + +HWTEST_F(ImageFormatConvertTest, PixelMapFormatConvert_034, TestSize.Level3) +{ + GTEST_LOG_(INFO) << "ImageFormatConvertTest.PixelMapFormatConvert_034: start"; + PixelFormat srcFormat = PixelFormat::YCBCR_P010; + PixelFormat destFormat = PixelFormat::RGB_565; + Size srcSize = { ODDTREE_ORIGINAL_WIDTH, ODDTREE_ORIGINAL_HEIGHT }; + uint32_t destBuffersize = srcSize.width * srcSize.height * BYTES_PER_PIXEL_RGB565; + PixelMap10bitConvert(srcFormat, destFormat, srcSize, destBuffersize); + GTEST_LOG_(INFO) << "ImageFormatConvertTest.PixelMapFormatConvert_034: end"; +} + /** * @tc.name: RGBConvertImageFormatOptionUnique_001 * @tc.desc: Verify RGB convert image format option using RGBConvertImageFormatOptionUnique. -- Gitee