From 56ec0818c3ed195c8de2daba951ddbcb4dc7d7bc Mon Sep 17 00:00:00 2001 From: Chris Palmer Date: Mon, 11 Sep 2017 11:13:24 -0700 Subject: Use the right allocate and free functions in OpenJPEG. This patch was authored by Ke Liu of Tencent's Xuanwu Lab. BUG=762374 Change-Id: Icb3ee98fb4c399b871ccf11e9920af7caf51be11 Reviewed-on: https://pdfium-review.googlesource.com/13610 Reviewed-by: Tom Sepez Commit-Queue: Chris Palmer --- core/fxcodec/codec/fx_codec_jpx_opj.cpp | 40 ++++++++++++---------- core/fxcodec/codec/fx_codec_jpx_unittest.cpp | 15 ++++---- .../libopenjpeg20/0035-opj_image_data_free.patch | 35 +++++++++++++++++++ third_party/libopenjpeg20/image.c | 2 +- third_party/libopenjpeg20/jp2.c | 4 +-- 5 files changed, 69 insertions(+), 27 deletions(-) create mode 100644 third_party/libopenjpeg20/0035-opj_image_data_free.patch diff --git a/core/fxcodec/codec/fx_codec_jpx_opj.cpp b/core/fxcodec/codec/fx_codec_jpx_opj.cpp index 007de0bdf3..b421e8fb2d 100644 --- a/core/fxcodec/codec/fx_codec_jpx_opj.cpp +++ b/core/fxcodec/codec/fx_codec_jpx_opj.cpp @@ -75,6 +75,7 @@ void sycc444_to_rgb(opj_image_t* img) { std::min({img->comps[0].h, img->comps[1].h, img->comps[2].h}); FX_SAFE_SIZE_T max_size = maxw; max_size *= maxh; + max_size *= sizeof(int); if (!max_size.IsValid()) return; @@ -84,18 +85,19 @@ void sycc444_to_rgb(opj_image_t* img) { if (!y || !cb || !cr) return; - int* r = static_cast(opj_calloc(max_size.ValueOrDie(), sizeof(int))); - int* g = static_cast(opj_calloc(max_size.ValueOrDie(), sizeof(int))); - int* b = static_cast(opj_calloc(max_size.ValueOrDie(), sizeof(int))); + int* r = static_cast(opj_image_data_alloc(max_size.ValueOrDie())); + int* g = static_cast(opj_image_data_alloc(max_size.ValueOrDie())); + int* b = static_cast(opj_image_data_alloc(max_size.ValueOrDie())); int* d0 = r; int* d1 = g; int* d2 = b; + max_size /= sizeof(int); for (size_t i = 0; i < max_size.ValueOrDie(); ++i) { sycc_to_rgb(offset, upb, *y++, *cb++, *cr++, r++, g++, b++); } - opj_free(img->comps[0].data); - opj_free(img->comps[1].data); - opj_free(img->comps[2].data); + opj_image_data_free(img->comps[0].data); + opj_image_data_free(img->comps[1].data); + opj_image_data_free(img->comps[2].data); img->comps[0].data = d0; img->comps[1].data = d1; img->comps[2].data = d2; @@ -132,6 +134,7 @@ void sycc422_to_rgb(opj_image_t* img) { OPJ_UINT32 maxh = img->comps[0].h; FX_SAFE_SIZE_T max_size = maxw; max_size *= maxh; + max_size *= sizeof(int); if (!max_size.IsValid()) return; @@ -141,9 +144,9 @@ void sycc422_to_rgb(opj_image_t* img) { if (!y || !cb || !cr) return; - int* r = static_cast(opj_calloc(max_size.ValueOrDie(), sizeof(int))); - int* g = static_cast(opj_calloc(max_size.ValueOrDie(), sizeof(int))); - int* b = static_cast(opj_calloc(max_size.ValueOrDie(), sizeof(int))); + int* r = static_cast(opj_image_data_alloc(max_size.ValueOrDie())); + int* g = static_cast(opj_image_data_alloc(max_size.ValueOrDie())); + int* b = static_cast(opj_image_data_alloc(max_size.ValueOrDie())); int* d0 = r; int* d1 = g; int* d2 = b; @@ -157,9 +160,9 @@ void sycc422_to_rgb(opj_image_t* img) { sycc_to_rgb(offset, upb, *y++, *cb++, *cr++, r++, g++, b++); } } - opj_free(img->comps[0].data); - opj_free(img->comps[1].data); - opj_free(img->comps[2].data); + opj_image_data_free(img->comps[0].data); + opj_image_data_free(img->comps[1].data); + opj_image_data_free(img->comps[2].data); img->comps[0].data = d0; img->comps[1].data = d1; img->comps[2].data = d2; @@ -308,12 +311,13 @@ void sycc420_to_rgb(opj_image_t* img) { bool exth = sycc420_must_extend_cbcr(yh, cbh); FX_SAFE_UINT32 safeSize = yw; safeSize *= yh; + safeSize *= sizeof(int); if (!safeSize.IsValid()) return; - int* r = static_cast(opj_calloc(safeSize.ValueOrDie(), sizeof(int))); - int* g = static_cast(opj_calloc(safeSize.ValueOrDie(), sizeof(int))); - int* b = static_cast(opj_calloc(safeSize.ValueOrDie(), sizeof(int))); + int* r = static_cast(opj_image_data_alloc(safeSize.ValueOrDie())); + int* g = static_cast(opj_image_data_alloc(safeSize.ValueOrDie())); + int* b = static_cast(opj_image_data_alloc(safeSize.ValueOrDie())); int* d0 = r; int* d1 = g; int* d2 = b; @@ -409,9 +413,9 @@ void sycc420_to_rgb(opj_image_t* img) { } } - opj_free(img->comps[0].data); - opj_free(img->comps[1].data); - opj_free(img->comps[2].data); + opj_image_data_free(img->comps[0].data); + opj_image_data_free(img->comps[1].data); + opj_image_data_free(img->comps[2].data); img->comps[0].data = d0; img->comps[1].data = d1; img->comps[2].data = d2; diff --git a/core/fxcodec/codec/fx_codec_jpx_unittest.cpp b/core/fxcodec/codec/fx_codec_jpx_unittest.cpp index cc5c8601b1..c1b20513cd 100644 --- a/core/fxcodec/codec/fx_codec_jpx_unittest.cpp +++ b/core/fxcodec/codec/fx_codec_jpx_unittest.cpp @@ -436,9 +436,12 @@ TEST(fxcodec, YUV420ToRGB) { y.h = y.w; img.x1 = y.w; img.y1 = y.h; - y.data = static_cast(opj_calloc(y.w * y.h, sizeof(OPJ_INT32))); - v.data = static_cast(opj_calloc(v.w * v.h, sizeof(OPJ_INT32))); - u.data = static_cast(opj_calloc(u.w * u.h, sizeof(OPJ_INT32))); + y.data = static_cast( + opj_image_data_alloc(y.w * y.h * sizeof(OPJ_INT32))); + v.data = static_cast( + opj_image_data_alloc(v.w * v.h * sizeof(OPJ_INT32))); + u.data = static_cast( + opj_image_data_alloc(u.w * u.h * sizeof(OPJ_INT32))); memset(y.data, 1, y.w * y.h * sizeof(OPJ_INT32)); memset(u.data, 0, u.w * u.h * sizeof(OPJ_INT32)); memset(v.data, 0, v.w * v.h * sizeof(OPJ_INT32)); @@ -457,9 +460,9 @@ TEST(fxcodec, YUV420ToRGB) { EXPECT_NE(img.comps[0].w, img.comps[2].w); EXPECT_NE(img.comps[0].h, img.comps[2].h); } - opj_free(img.comps[0].data); - opj_free(img.comps[1].data); - opj_free(img.comps[2].data); + opj_image_data_free(img.comps[0].data); + opj_image_data_free(img.comps[1].data); + opj_image_data_free(img.comps[2].data); } FX_Free(img.comps); } diff --git a/third_party/libopenjpeg20/0035-opj_image_data_free.patch b/third_party/libopenjpeg20/0035-opj_image_data_free.patch new file mode 100644 index 0000000000..8bd03a214e --- /dev/null +++ b/third_party/libopenjpeg20/0035-opj_image_data_free.patch @@ -0,0 +1,35 @@ +diff --git a/third_party/libopenjpeg20/image.c b/third_party/libopenjpeg20/image.c +index e29172b2b..bf7a70194 100644 +--- a/third_party/libopenjpeg20/image.c ++++ b/third_party/libopenjpeg20/image.c +@@ -180,7 +180,7 @@ void opj_copy_image_header(const opj_image_t* p_image_src, + for (compno = 0; compno < p_image_dest->numcomps; compno++) { + opj_image_comp_t *image_comp = &(p_image_dest->comps[compno]); + if (image_comp->data) { +- opj_free(image_comp->data); ++ opj_image_data_free(image_comp->data); + } + } + opj_free(p_image_dest->comps); +diff --git a/third_party/libopenjpeg20/jp2.c b/third_party/libopenjpeg20/jp2.c +index 9178f3fd6..e7e2db8bb 100644 +--- a/third_party/libopenjpeg20/jp2.c ++++ b/third_party/libopenjpeg20/jp2.c +@@ -1083,7 +1083,7 @@ static OPJ_BOOL opj_jp2_apply_pclr(opj_image_t *image, + if (!new_comps[i].data) { + while (i > 0) { + -- i; +- opj_free(new_comps[i].data); ++ opj_image_data_free(new_comps[i].data); + } + opj_free(new_comps); + opj_event_msg(p_manager, EVT_ERROR, +@@ -1107,7 +1107,7 @@ static OPJ_BOOL opj_jp2_apply_pclr(opj_image_t *image, + /* Prevent null pointer access */ + if (!src || !dst) { + for (j = 0; j < nr_channels; ++j) { +- opj_free(new_comps[j].data); ++ opj_image_data_free(new_comps[j].data); + } + opj_free(new_comps); + new_comps = NULL; diff --git a/third_party/libopenjpeg20/image.c b/third_party/libopenjpeg20/image.c index e29172b2b5..bf7a701942 100644 --- a/third_party/libopenjpeg20/image.c +++ b/third_party/libopenjpeg20/image.c @@ -180,7 +180,7 @@ void opj_copy_image_header(const opj_image_t* p_image_src, for (compno = 0; compno < p_image_dest->numcomps; compno++) { opj_image_comp_t *image_comp = &(p_image_dest->comps[compno]); if (image_comp->data) { - opj_free(image_comp->data); + opj_image_data_free(image_comp->data); } } opj_free(p_image_dest->comps); diff --git a/third_party/libopenjpeg20/jp2.c b/third_party/libopenjpeg20/jp2.c index 9178f3fd63..e7e2db8bb4 100644 --- a/third_party/libopenjpeg20/jp2.c +++ b/third_party/libopenjpeg20/jp2.c @@ -1083,7 +1083,7 @@ static OPJ_BOOL opj_jp2_apply_pclr(opj_image_t *image, if (!new_comps[i].data) { while (i > 0) { -- i; - opj_free(new_comps[i].data); + opj_image_data_free(new_comps[i].data); } opj_free(new_comps); opj_event_msg(p_manager, EVT_ERROR, @@ -1107,7 +1107,7 @@ static OPJ_BOOL opj_jp2_apply_pclr(opj_image_t *image, /* Prevent null pointer access */ if (!src || !dst) { for (j = 0; j < nr_channels; ++j) { - opj_free(new_comps[j].data); + opj_image_data_free(new_comps[j].data); } opj_free(new_comps); new_comps = NULL; -- cgit v1.2.3