commit ee98be7811ca82ab92ab4e1c0cfc203283e79652
author Sami Kalliomäki <sakal@webrtc.org> Tue May 08 15:22:08 2018 +0200
committer Commit Bot <commit-bot@chromium.org> Wed May 09 09:15:46 2018 +0000
tree 957b84f83930acc2e56c3fd993324e71a15f68ba
parent c710ac142e6ed9f7c880aa6b1b1dca6fbae2f1e9

Fix handling non-tightly packed ByteBuffers in HardwareVideoDecoder.

Before this CL, there would be an out-of-bounds write in the ByteBuffer
copying when a decoded frame had height != sliceHeight.

Bug: webrtc:9194
Change-Id: Ibb80e5555e8f00d9e1fd4cb8a73f5e4ccd5a0b81
Tested: 640x360 loopback with eglContext == null in AppRTCMobile on Pixel.
Reviewed-on: https://webrtc-review.googlesource.com/74120
Commit-Queue: Sami Kalliomäki <sakal@webrtc.org>
Reviewed-by: Rasmus Brandt <brandtr@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#23184}

sdk/android/api/org/webrtc/VideoFrameDrawer.java

diff --git a/sdk/android/api/org/webrtc/VideoFrameDrawer.java b/sdk/android/api/org/webrtc/VideoFrameDrawer.java
index d2c5be2..9909f37 100644
--- a/sdk/android/api/org/webrtc/VideoFrameDrawer.java
+++ b/sdk/android/api/org/webrtc/VideoFrameDrawer.java
@@ -13,8 +13,8 @@
 import android.graphics.Matrix;
 import android.graphics.Point;
 import android.opengl.GLES20;
-import javax.annotation.Nullable;
 import java.nio.ByteBuffer;
+import javax.annotation.Nullable;
 
 /**
  * Helper class to draw VideoFrames. Calls either drawer.drawOes, drawer.drawRgb, or
@@ -98,8 +98,8 @@
           // Input is packed already.
           packedByteBuffer = planes[i];
         } else {
-          nativeCopyPlane(
-              planes[i], planeWidths[i], planeHeights[i], strides[i], copyBuffer, planeWidths[i]);
+          YuvHelper.copyPlane(
+              planes[i], strides[i], copyBuffer, planeWidths[i], planeWidths[i], planeHeights[i]);
           packedByteBuffer = copyBuffer;
         }
         GLES20.glTexImage2D(GLES20.GL_TEXTURE_2D, 0, GLES20.GL_LUMINANCE, planeWidths[i],
@@ -229,8 +229,4 @@
     yuvUploader.release();
     lastI420Frame = null;
   }
-
-  // Helper native function to do a video frame plane copying.
-  static native void nativeCopyPlane(
-      ByteBuffer src, int width, int height, int srcStride, ByteBuffer dst, int dstStride);
 }

sdk/android/api/org/webrtc/YuvHelper.java

diff --git a/sdk/android/api/org/webrtc/YuvHelper.java b/sdk/android/api/org/webrtc/YuvHelper.java
index 105584c..da94fec 100644
--- a/sdk/android/api/org/webrtc/YuvHelper.java
+++ b/sdk/android/api/org/webrtc/YuvHelper.java
@@ -97,6 +97,12 @@
         dstChromaWidth, dstV, dstChromaWidth, srcWidth, srcHeight, rotationMode);
   }
 
+  /** Helper method for copying a single colour plane. */
+  public static void copyPlane(
+      ByteBuffer src, int srcStride, ByteBuffer dst, int dstStride, int width, int height) {
+    nativeCopyPlane(src, srcStride, dst, dstStride, width, height);
+  }
+
   public static void I420Copy(ByteBuffer srcY, int srcStrideY, ByteBuffer srcU, int srcStrideU,
       ByteBuffer srcV, int srcStrideV, ByteBuffer dstY, int dstStrideY, ByteBuffer dstU,
       int dstStrideU, ByteBuffer dstV, int dstStrideV, int width, int height) {
@@ -119,6 +125,8 @@
         dstStrideU, dstV, dstStrideV, srcWidth, srcHeight, rotationMode);
   }
 
+  private static native void nativeCopyPlane(
+      ByteBuffer src, int srcStride, ByteBuffer dst, int dstStride, int width, int height);
   private static native void nativeI420Copy(ByteBuffer srcY, int srcStrideY, ByteBuffer srcU,
       int srcStrideU, ByteBuffer srcV, int srcStrideV, ByteBuffer dstY, int dstStrideY,
       ByteBuffer dstU, int dstStrideU, ByteBuffer dstV, int dstStrideV, int width, int height);