shithub: libvpx

Info  •  Files  •  Log  •  Branches

Fix oob in vpx_setup_noise

Array index wasn't checked on boundary.

BUG=webm:1572

Change-Id: I55a93c024af77a4fd904b0e992d5587a142d66a4

--- a/test/add_noise_test.cc

+++ b/test/add_noise_test.cc

@@ -10,6 +10,7 @@

 #include <math.h>

 #include "test/clear_system_state.h"

 #include "test/register_state_check.h"

+#include "test/util.h"

 #include "third_party/googletest/src/include/gtest/gtest.h"

 #include "./vpx_dsp_rtcd.h"

 #include "vpx/vpx_integer.h"

@@ -25,7 +26,10 @@

                              int blackclamp, int whiteclamp, int width,

                              int height, int pitch);

-class AddNoiseTest : public ::testing::TestWithParam<AddNoiseFunc> {

+typedef ::testing::tuple<double, AddNoiseFunc> AddNoiseTestFPParam;

+

+class AddNoiseTest : public ::testing::Test,

+                     public ::testing::WithParamInterface<AddNoiseTestFPParam> {

  public:

   virtual void TearDown() { libvpx_test::ClearSystemState(); }

   virtual ~AddNoiseTest() {}

@@ -44,7 +48,7 @@

   const int height = 64;

   const int image_size = width * height;

   int8_t noise[kNoiseSize];

-  const int clamp = vpx_setup_noise(4.4, noise, kNoiseSize);

+  const int clamp = vpx_setup_noise(GET_PARAM(0), noise, kNoiseSize);

   uint8_t *const s =

       reinterpret_cast<uint8_t *>(vpx_calloc(image_size, sizeof(*s)));

   ASSERT_TRUE(s != NULL);

@@ -51,7 +55,7 @@

   memset(s, 99, image_size * sizeof(*s));

   ASM_REGISTER_STATE_CHECK(

-      GetParam()(s, noise, clamp, clamp, width, height, width));

+      GET_PARAM(1)(s, noise, clamp, clamp, width, height, width));

   // Check to make sure we don't end up having either the same or no added

   // noise either vertically or horizontally.

@@ -70,7 +74,7 @@

   memset(s, 255, image_size);

   ASM_REGISTER_STATE_CHECK(

-      GetParam()(s, noise, clamp, clamp, width, height, width));

+      GET_PARAM(1)(s, noise, clamp, clamp, width, height, width));

   // Check to make sure don't roll over.

   for (int i = 0; i < image_size; ++i) {

@@ -81,7 +85,7 @@

   memset(s, 0, image_size);

   ASM_REGISTER_STATE_CHECK(

-      GetParam()(s, noise, clamp, clamp, width, height, width));

+      GET_PARAM(1)(s, noise, clamp, clamp, width, height, width));

   // Check to make sure don't roll under.

   for (int i = 0; i < image_size; ++i) {

@@ -108,7 +112,7 @@

   srand(0);

   ASM_REGISTER_STATE_CHECK(

-      GetParam()(s, noise, clamp, clamp, width, height, width));

+      GET_PARAM(1)(s, noise, clamp, clamp, width, height, width));

   srand(0);

   ASM_REGISTER_STATE_CHECK(

       vpx_plane_add_noise_c(d, noise, clamp, clamp, width, height, width));

@@ -121,16 +125,24 @@

   vpx_free(s);

 }

-INSTANTIATE_TEST_CASE_P(C, AddNoiseTest,

-                        ::testing::Values(vpx_plane_add_noise_c));

+using ::testing::make_tuple;

+INSTANTIATE_TEST_CASE_P(

+    C, AddNoiseTest,

+    ::testing::Values(make_tuple(3.25, vpx_plane_add_noise_c),

+                      make_tuple(4.4, vpx_plane_add_noise_c)));

+

 #if HAVE_SSE2

-INSTANTIATE_TEST_CASE_P(SSE2, AddNoiseTest,

-                        ::testing::Values(vpx_plane_add_noise_sse2));

+INSTANTIATE_TEST_CASE_P(

+    SSE2, AddNoiseTest,

+    ::testing::Values(make_tuple(3.25, vpx_plane_add_noise_sse2),

+                      make_tuple(4.4, vpx_plane_add_noise_sse2)));

 #endif

 #if HAVE_MSA

-INSTANTIATE_TEST_CASE_P(MSA, AddNoiseTest,

-                        ::testing::Values(vpx_plane_add_noise_msa));

+INSTANTIATE_TEST_CASE_P(

+    MSA, AddNoiseTest,

+    ::testing::Values(make_tuple(3.25, vpx_plane_add_noise_msa),

+                      make_tuple(4.4, vpx_plane_add_noise_msa)));

 #endif

 }  // namespace

--- a/vpx_dsp/add_noise.c

+++ b/vpx_dsp/add_noise.c

@@ -52,6 +52,7 @@

     const int a_i = (int)(0.5 + 256 * gaussian(sigma, 0, i));

     if (a_i) {

       for (j = 0; j < a_i; ++j) {

+        if (next + j >= 256) goto set_noise;

         char_dist[next + j] = (int8_t)i;

       }

       next = next + j;

@@ -63,6 +64,7 @@

     char_dist[next] = 0;

   }

+set_noise:

   for (i = 0; i < size; ++i) {

     noise[i] = char_dist[rand() & 0xff];  // NOLINT

   }