commit f63125c42183c26fe871348d213d5628c8dfe32d
author Dichen Zhang <dichenzhang@google.com> Mon Jul 31 22:27:27 2023 +0000
committer Dichen Zhang <dichenzhang@google.com> Tue Aug 01 05:07:46 2023 +0000
tree 4d500e4dcb2d58b7d18a0534b627becfd4849f1e
parent 9bd0c2badd3190edc106930933f395d89e0a4e33

ultrahdr: handle unsupported sampling formats

If primary/gain-map image sampling format is not as expected mark
the api call for failure

Bug: 290504502
Test: ./ultrahdr_dec_fuzzer
Change-Id: I039bd2d198c13d236cc8687461519194451e63d4

libs/ultrahdr/jpegdecoderhelper.cpp

diff --git a/libs/ultrahdr/jpegdecoderhelper.cpp b/libs/ultrahdr/jpegdecoderhelper.cpp
index fef5444..d22f4ec 100644
--- a/libs/ultrahdr/jpegdecoderhelper.cpp
+++ b/libs/ultrahdr/jpegdecoderhelper.cpp
@@ -227,10 +227,20 @@
     mHeight = cinfo.image_height;
 
     if (decodeToRGBA) {
-        if (cinfo.jpeg_color_space == JCS_GRAYSCALE) {
-            // We don't intend to support decoding grayscale to RGBA
-            status = false;
-            ALOGE("%s: decoding grayscale to RGBA is unsupported", __func__);
+        // The primary image is expected to be yuv420 sampling
+            if (cinfo.jpeg_color_space != JCS_YCbCr) {
+                status = false;
+                ALOGE("%s: decodeToRGBA unexpected jpeg color space ", __func__);
+                goto CleanUp;
+            }
+            if (cinfo.comp_info[0].h_samp_factor != 2 ||
+                    cinfo.comp_info[1].h_samp_factor != 1 ||
+                    cinfo.comp_info[2].h_samp_factor != 1 ||
+                    cinfo.comp_info[0].v_samp_factor != 2 ||
+                    cinfo.comp_info[1].v_samp_factor != 1 ||
+                    cinfo.comp_info[2].v_samp_factor != 1 ) {
+                status = false;
+                ALOGE("%s: decodeToRGBA unexpected primary image sub-sampling", __func__);
             goto CleanUp;
         }
         // 4 bytes per pixel
@@ -251,6 +261,10 @@
             mResultBuffer.resize(cinfo.image_width * cinfo.image_height * 3 / 2, 0);
         } else if (cinfo.jpeg_color_space == JCS_GRAYSCALE) {
             mResultBuffer.resize(cinfo.image_width * cinfo.image_height, 0);
+        } else {
+            status = false;
+            ALOGE("%s: decodeToYUV unexpected jpeg color space", __func__);
+            goto CleanUp;
         }
         cinfo.out_color_space = cinfo.jpeg_color_space;
         cinfo.raw_data_out = TRUE;