commit cd59f03de854b688b3edf7e3a459be1097f091fe
author Harish Mahendrakar <harish.mahendrakar@ittiam.com> Fri Apr 16 18:55:41 2021 -0700
committer Harish Mahendrakar <harish.mahendrakar@ittiam.com> Fri Apr 16 18:55:45 2021 -0700
tree 271a940a58afe37b36e0bc62e167ad257ee29249
parent d22cd941c86d084ff8e78567ca9886d485737304

Codec2BufferUtils.cpp: Fix integer-overflows

Fix integer overflows in IsNV12 and IsNV21

Bug: 185277572
Test: atest VtsHalMediaC2V1_0TargetVideoEncTest

Change-Id: I940456cf7f26696f42d885531b0b73d064de921e

media/codec2/sfplugin/utils/Codec2BufferUtils.cpp

diff --git a/media/codec2/sfplugin/utils/Codec2BufferUtils.cpp b/media/codec2/sfplugin/utils/Codec2BufferUtils.cpp
index a78d811..0966988 100644
--- a/media/codec2/sfplugin/utils/Codec2BufferUtils.cpp
+++ b/media/codec2/sfplugin/utils/Codec2BufferUtils.cpp
@@ -346,7 +346,7 @@
     }
     return (img->mPlane[1].mColInc == 2
             && img->mPlane[2].mColInc == 2
-            && (img->mPlane[2].mOffset - img->mPlane[1].mOffset == 1));
+            && (img->mPlane[2].mOffset == img->mPlane[1].mOffset + 1));
 }
 
 bool IsNV21(const MediaImage2 *img) {
@@ -355,7 +355,7 @@
     }
     return (img->mPlane[1].mColInc == 2
             && img->mPlane[2].mColInc == 2
-            && (img->mPlane[1].mOffset - img->mPlane[2].mOffset == 1));
+            && (img->mPlane[1].mOffset == img->mPlane[2].mOffset + 1));
 }
 
 bool IsI420(const MediaImage2 *img) {