diff options
author | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | 2023-06-06 23:16:56 +0000 |
---|---|---|
committer | Android Build Coastguard Worker <android-build-coastguard-worker@google.com> | 2023-06-06 23:16:56 +0000 |
commit | 5d16e393f360577f1b8e0e7db93105839ee8a32d (patch) | |
tree | cd416502c7828d921e483c49c6e682bb90296e83 | |
parent | 68ecaf72f461e89e053b1ed57bfc660bccdaa201 (diff) | |
parent | fcb80a221e7ac3548ff5d751eea14c708a6f43fd (diff) | |
download | native-5d16e393f360577f1b8e0e7db93105839ee8a32d.tar.gz |
Snap for 10269577 from fcb80a221e7ac3548ff5d751eea14c708a6f43fd to udc-release
Change-Id: I7ec4a375f69f29336ff84c4dddcf3a44805dba11
-rw-r--r-- | data/etc/Android.bp | 12 | ||||
-rw-r--r-- | libs/ultrahdr/fuzzer/Android.bp | 36 | ||||
-rw-r--r-- | libs/ultrahdr/fuzzer/ultrahdr_dec_fuzzer.cpp | 73 | ||||
-rw-r--r-- | libs/ultrahdr/fuzzer/ultrahdr_enc_fuzzer.cpp | 23 | ||||
-rw-r--r-- | libs/ultrahdr/icc.cpp | 18 | ||||
-rw-r--r-- | libs/ultrahdr/include/ultrahdr/jpegdecoderhelper.h | 4 | ||||
-rw-r--r-- | libs/ultrahdr/jpegdecoderhelper.cpp | 24 | ||||
-rw-r--r-- | libs/ultrahdr/jpegencoderhelper.cpp | 11 | ||||
-rw-r--r-- | libs/ultrahdr/jpegr.cpp | 15 | ||||
-rw-r--r-- | libs/ultrahdr/multipictureformat.cpp | 2 |
10 files changed, 167 insertions, 51 deletions
diff --git a/data/etc/Android.bp b/data/etc/Android.bp index 754e7b2ac0..226cae12aa 100644 --- a/data/etc/Android.bp +++ b/data/etc/Android.bp @@ -329,6 +329,12 @@ prebuilt_etc { } prebuilt_etc { + name: "android.software.opengles.deqp.level-2023-03-01.prebuilt.xml", + src: "android.software.opengles.deqp.level-2023-03-01.xml", + defaults: ["frameworks_native_data_etc_defaults"], +} + +prebuilt_etc { name: "android.software.sip.voip.prebuilt.xml", src: "android.software.sip.voip.xml", defaults: ["frameworks_native_data_etc_defaults"], @@ -353,6 +359,12 @@ prebuilt_etc { } prebuilt_etc { + name: "android.software.vulkan.deqp.level-2023-03-01.prebuilt.xml", + src: "android.software.vulkan.deqp.level-2023-03-01.xml", + defaults: ["frameworks_native_data_etc_defaults"], +} + +prebuilt_etc { name: "aosp_excluded_hardware.prebuilt.xml", src: "aosp_excluded_hardware.xml", defaults: ["frameworks_native_data_etc_defaults"], diff --git a/libs/ultrahdr/fuzzer/Android.bp b/libs/ultrahdr/fuzzer/Android.bp index 27b38c3590..6c0a2f577c 100644 --- a/libs/ultrahdr/fuzzer/Android.bp +++ b/libs/ultrahdr/fuzzer/Android.bp @@ -24,7 +24,17 @@ package { cc_defaults { name: "ultrahdr_fuzzer_defaults", host_supported: true, - static_libs: ["liblog"], + shared_libs: [ + "libimage_io", + "libjpeg", + ], + static_libs: [ + "libjpegdecoder", + "libjpegencoder", + "libultrahdr", + "libutils", + "liblog", + ], target: { darwin: { enabled: false, @@ -37,6 +47,8 @@ cc_defaults { description: "The fuzzers target the APIs of jpeg hdr", service_privilege: "constrained", users: "multi_user", + fuzzed_code_usage: "future_version", + vector: "local_no_privileges_required", }, } @@ -46,20 +58,12 @@ cc_fuzz { srcs: [ "ultrahdr_enc_fuzzer.cpp", ], - shared_libs: [ - "libimage_io", - "libjpeg", - "liblog", - ], - static_libs: [ - "libjpegdecoder", - "libjpegencoder", - "libultrahdr", - "libutils", - ], - fuzz_config: { - fuzzed_code_usage: "future_version", - vector: "local_no_privileges_required", - }, } +cc_fuzz { + name: "ultrahdr_dec_fuzzer", + defaults: ["ultrahdr_fuzzer_defaults"], + srcs: [ + "ultrahdr_dec_fuzzer.cpp", + ], +} diff --git a/libs/ultrahdr/fuzzer/ultrahdr_dec_fuzzer.cpp b/libs/ultrahdr/fuzzer/ultrahdr_dec_fuzzer.cpp new file mode 100644 index 0000000000..ad1d57aaee --- /dev/null +++ b/libs/ultrahdr/fuzzer/ultrahdr_dec_fuzzer.cpp @@ -0,0 +1,73 @@ +/* + * Copyright 2023 The Android Open Source Project + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +// System include files +#include <fuzzer/FuzzedDataProvider.h> +#include <iostream> +#include <vector> + +// User include files +#include "ultrahdr/jpegr.h" + +using namespace android::ultrahdr; + +// Transfer functions for image data, sync with ultrahdr.h +const int kOfMin = ULTRAHDR_OUTPUT_UNSPECIFIED + 1; +const int kOfMax = ULTRAHDR_OUTPUT_MAX; + +class UltraHdrDecFuzzer { +public: + UltraHdrDecFuzzer(const uint8_t* data, size_t size) : mFdp(data, size){}; + void process(); + +private: + FuzzedDataProvider mFdp; +}; + +void UltraHdrDecFuzzer::process() { + // hdr_of + auto of = static_cast<ultrahdr_output_format>(mFdp.ConsumeIntegralInRange<int>(kOfMin, kOfMax)); + auto buffer = mFdp.ConsumeRemainingBytes<uint8_t>(); + jpegr_compressed_struct jpegImgR{buffer.data(), (int)buffer.size(), (int)buffer.size(), + ULTRAHDR_COLORGAMUT_UNSPECIFIED}; + + std::vector<uint8_t> iccData(0); + std::vector<uint8_t> exifData(0); + jpegr_info_struct info{0, 0, &iccData, &exifData}; + JpegR jpegHdr; + (void)jpegHdr.getJPEGRInfo(&jpegImgR, &info); +//#define DUMP_PARAM +#ifdef DUMP_PARAM + std::cout << "input buffer size " << jpegImgR.length << std::endl; + std::cout << "image dimensions " << info.width << " x " << info.width << std::endl; +#endif + size_t outSize = info.width * info.height * ((of == ULTRAHDR_OUTPUT_SDR) ? 4 : 8); + jpegr_uncompressed_struct decodedJpegR; + auto decodedRaw = std::make_unique<uint8_t[]>(outSize); + decodedJpegR.data = decodedRaw.get(); + ultrahdr_metadata_struct metadata; + jpegr_uncompressed_struct decodedGainMap{}; + (void)jpegHdr.decodeJPEGR(&jpegImgR, &decodedJpegR, + mFdp.ConsumeFloatingPointInRange<float>(1.0, FLT_MAX), nullptr, of, + &decodedGainMap, &metadata); + if (decodedGainMap.data) free(decodedGainMap.data); +} + +extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { + UltraHdrDecFuzzer fuzzHandle(data, size); + fuzzHandle.process(); + return 0; +} diff --git a/libs/ultrahdr/fuzzer/ultrahdr_enc_fuzzer.cpp b/libs/ultrahdr/fuzzer/ultrahdr_enc_fuzzer.cpp index 7faa1570f0..acb9b795c0 100644 --- a/libs/ultrahdr/fuzzer/ultrahdr_enc_fuzzer.cpp +++ b/libs/ultrahdr/fuzzer/ultrahdr_enc_fuzzer.cpp @@ -55,12 +55,9 @@ const int kOfMax = ULTRAHDR_OUTPUT_MAX; const int kQfMin = 0; const int kQfMax = 100; -// seed -const unsigned kSeed = 0x7ab7; - -class JpegHDRFuzzer { +class UltraHdrEncFuzzer { public: - JpegHDRFuzzer(const uint8_t* data, size_t size) : mFdp(data, size){}; + UltraHdrEncFuzzer(const uint8_t* data, size_t size) : mFdp(data, size){}; void process(); void fillP010Buffer(uint16_t* data, int width, int height, int stride); void fill420Buffer(uint8_t* data, int size); @@ -69,7 +66,7 @@ private: FuzzedDataProvider mFdp; }; -void JpegHDRFuzzer::fillP010Buffer(uint16_t* data, int width, int height, int stride) { +void UltraHdrEncFuzzer::fillP010Buffer(uint16_t* data, int width, int height, int stride) { uint16_t* tmp = data; std::vector<uint16_t> buffer(16); for (int i = 0; i < buffer.size(); i++) { @@ -78,22 +75,24 @@ void JpegHDRFuzzer::fillP010Buffer(uint16_t* data, int width, int height, int st for (int j = 0; j < height; j++) { for (int i = 0; i < width; i += buffer.size()) { memcpy(data + i, buffer.data(), std::min((int)buffer.size(), (width - i))); - std::shuffle(buffer.begin(), buffer.end(), std::default_random_engine(kSeed)); + std::shuffle(buffer.begin(), buffer.end(), + std::default_random_engine(std::random_device{}())); } tmp += stride; } } -void JpegHDRFuzzer::fill420Buffer(uint8_t* data, int size) { +void UltraHdrEncFuzzer::fill420Buffer(uint8_t* data, int size) { std::vector<uint8_t> buffer(16); mFdp.ConsumeData(buffer.data(), buffer.size()); for (int i = 0; i < size; i += buffer.size()) { memcpy(data + i, buffer.data(), std::min((int)buffer.size(), (size - i))); - std::shuffle(buffer.begin(), buffer.end(), std::default_random_engine(kSeed)); + std::shuffle(buffer.begin(), buffer.end(), + std::default_random_engine(std::random_device{}())); } } -void JpegHDRFuzzer::process() { +void UltraHdrEncFuzzer::process() { while (mFdp.remaining_bytes()) { struct jpegr_uncompressed_struct p010Img {}; struct jpegr_uncompressed_struct yuv420Img {}; @@ -256,7 +255,7 @@ void JpegHDRFuzzer::process() { } else if (tf == ULTRAHDR_TF_PQ) { metadata.maxContentBoost = kPqMaxNits / kSdrWhiteNits; } else { - metadata.maxContentBoost = 0; + metadata.maxContentBoost = 1.0f; } metadata.minContentBoost = 1.0f; status = jpegHdr.encodeJPEGR(&jpegImg, &jpegGainMap, &metadata, &jpegImgR); @@ -293,7 +292,7 @@ void JpegHDRFuzzer::process() { } extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) { - JpegHDRFuzzer fuzzHandle(data, size); + UltraHdrEncFuzzer fuzzHandle(data, size); fuzzHandle.process(); return 0; } diff --git a/libs/ultrahdr/icc.cpp b/libs/ultrahdr/icc.cpp index c807705528..32d08aa525 100644 --- a/libs/ultrahdr/icc.cpp +++ b/libs/ultrahdr/icc.cpp @@ -180,7 +180,7 @@ sp<DataStruct> IccHelper::write_text_tag(const char* text) { uint32_t total_length = text_length * 2 + sizeof(header); total_length = (((total_length + 2) >> 2) << 2); // 4 aligned - sp<DataStruct> dataStruct = new DataStruct(total_length); + sp<DataStruct> dataStruct = sp<DataStruct>::make(total_length); if (!dataStruct->write(header, sizeof(header))) { ALOGE("write_text_tag(): error in writing data"); @@ -204,7 +204,7 @@ sp<DataStruct> IccHelper::write_xyz_tag(float x, float y, float z) { static_cast<uint32_t>(Endian_SwapBE32(float_round_to_fixed(y))), static_cast<uint32_t>(Endian_SwapBE32(float_round_to_fixed(z))), }; - sp<DataStruct> dataStruct = new DataStruct(sizeof(data)); + sp<DataStruct> dataStruct = sp<DataStruct>::make(sizeof(data)); dataStruct->write(&data, sizeof(data)); return dataStruct; } @@ -212,7 +212,7 @@ sp<DataStruct> IccHelper::write_xyz_tag(float x, float y, float z) { sp<DataStruct> IccHelper::write_trc_tag(const int table_entries, const void* table_16) { int total_length = 4 + 4 + 4 + table_entries * 2; total_length = (((total_length + 2) >> 2) << 2); // 4 aligned - sp<DataStruct> dataStruct = new DataStruct(total_length); + sp<DataStruct> dataStruct = sp<DataStruct>::make(total_length); dataStruct->write32(Endian_SwapBE32(kTAG_CurveType)); // Type dataStruct->write32(0); // Reserved dataStruct->write32(Endian_SwapBE32(table_entries)); // Value count @@ -225,7 +225,7 @@ sp<DataStruct> IccHelper::write_trc_tag(const int table_entries, const void* tab sp<DataStruct> IccHelper::write_trc_tag_for_linear() { int total_length = 16; - sp<DataStruct> dataStruct = new DataStruct(total_length); + sp<DataStruct> dataStruct = sp<DataStruct>::make(total_length); dataStruct->write32(Endian_SwapBE32(kTAG_ParaCurveType)); // Type dataStruct->write32(0); // Reserved dataStruct->write32(Endian_SwapBE16(kExponential_ParaCurveType)); @@ -263,7 +263,7 @@ float IccHelper::compute_tone_map_gain(const ultrahdr_transfer_function tf, floa sp<DataStruct> IccHelper::write_cicp_tag(uint32_t color_primaries, uint32_t transfer_characteristics) { int total_length = 12; // 4 + 4 + 1 + 1 + 1 + 1 - sp<DataStruct> dataStruct = new DataStruct(total_length); + sp<DataStruct> dataStruct = sp<DataStruct>::make(total_length); dataStruct->write32(Endian_SwapBE32(kTAG_cicp)); // Type signature dataStruct->write32(0); // Reserved dataStruct->write8(color_primaries); // Color primaries @@ -314,7 +314,7 @@ sp<DataStruct> IccHelper::write_clut(const uint8_t* grid_points, const uint8_t* int total_length = 20 + 2 * value_count; total_length = (((total_length + 2) >> 2) << 2); // 4 aligned - sp<DataStruct> dataStruct = new DataStruct(total_length); + sp<DataStruct> dataStruct = sp<DataStruct>::make(total_length); for (size_t i = 0; i < 16; ++i) { dataStruct->write8(i < kNumChannels ? grid_points[i] : 0); // Grid size @@ -372,7 +372,7 @@ sp<DataStruct> IccHelper::write_mAB_or_mBA_tag(uint32_t type, total_length += a_curves_data[i]->getLength(); } } - sp<DataStruct> dataStruct = new DataStruct(total_length); + sp<DataStruct> dataStruct = sp<DataStruct>::make(total_length); dataStruct->write32(Endian_SwapBE32(type)); // Type signature dataStruct->write32(0); // Reserved dataStruct->write8(kNumChannels); // Input channels @@ -421,7 +421,7 @@ sp<DataStruct> IccHelper::writeIccProfile(ultrahdr_transfer_function tf, break; default: // Should not fall here. - return new DataStruct(0); + return nullptr; } // Compute primaries. @@ -546,7 +546,7 @@ sp<DataStruct> IccHelper::writeIccProfile(ultrahdr_transfer_function tf, header.size = Endian_SwapBE32(profile_size); header.tag_count = Endian_SwapBE32(tags.size()); - sp<DataStruct> dataStruct = new DataStruct(profile_size); + sp<DataStruct> dataStruct = sp<DataStruct>::make(profile_size); if (!dataStruct->write(&header, sizeof(header))) { ALOGE("writeIccProfile(): error in header"); return dataStruct; diff --git a/libs/ultrahdr/include/ultrahdr/jpegdecoderhelper.h b/libs/ultrahdr/include/ultrahdr/jpegdecoderhelper.h index f642bad89c..4f2b7423c8 100644 --- a/libs/ultrahdr/include/ultrahdr/jpegdecoderhelper.h +++ b/libs/ultrahdr/include/ultrahdr/jpegdecoderhelper.h @@ -25,6 +25,10 @@ extern "C" { } #include <utils/Errors.h> #include <vector> + +static const int kMaxWidth = 8192; +static const int kMaxHeight = 8192; + namespace android::ultrahdr { /* * Encapsulates a converter from JPEG to raw image (YUV420planer or grey-scale) format. diff --git a/libs/ultrahdr/jpegdecoderhelper.cpp b/libs/ultrahdr/jpegdecoderhelper.cpp index fac90c503d..0bad4a4de0 100644 --- a/libs/ultrahdr/jpegdecoderhelper.cpp +++ b/libs/ultrahdr/jpegdecoderhelper.cpp @@ -150,6 +150,7 @@ bool JpegDecoderHelper::decode(const void* image, int length, bool decodeToRGBA) jpeg_decompress_struct cinfo; jpegr_source_mgr mgr(static_cast<const uint8_t*>(image), length); jpegrerror_mgr myerr; + bool status = true; cinfo.err = jpeg_std_error(&myerr.pub); myerr.pub.error_exit = jpegrerror_exit; @@ -213,13 +214,21 @@ bool JpegDecoderHelper::decode(const void* image, int length, bool decodeToRGBA) } } + if (cinfo.image_width > kMaxWidth || cinfo.image_height > kMaxHeight) { + // constraint on max width and max height is only due to alloc constraints + // tune these values basing on the target device + status = false; + goto CleanUp; + } + mWidth = cinfo.image_width; mHeight = cinfo.image_height; if (decodeToRGBA) { if (cinfo.jpeg_color_space == JCS_GRAYSCALE) { // We don't intend to support decoding grayscale to RGBA - return false; + status = false; + goto CleanUp; } // 4 bytes per pixel mResultBuffer.resize(cinfo.image_width * cinfo.image_height * 4); @@ -232,7 +241,8 @@ bool JpegDecoderHelper::decode(const void* image, int length, bool decodeToRGBA) cinfo.comp_info[0].v_samp_factor != 2 || cinfo.comp_info[1].v_samp_factor != 1 || cinfo.comp_info[2].v_samp_factor != 1) { - return false; + status = false; + goto CleanUp; } mResultBuffer.resize(cinfo.image_width * cinfo.image_height * 3 / 2, 0); } else if (cinfo.jpeg_color_space == JCS_GRAYSCALE) { @@ -248,13 +258,15 @@ bool JpegDecoderHelper::decode(const void* image, int length, bool decodeToRGBA) if (!decompress(&cinfo, static_cast<const uint8_t*>(mResultBuffer.data()), cinfo.jpeg_color_space == JCS_GRAYSCALE)) { - return false; + status = false; + goto CleanUp; } +CleanUp: jpeg_finish_decompress(&cinfo); jpeg_destroy_decompress(&cinfo); - return true; + return status; } bool JpegDecoderHelper::decompress(jpeg_decompress_struct* cinfo, const uint8_t* dest, @@ -361,7 +373,7 @@ bool JpegDecoderHelper::decompressYUV(jpeg_decompress_struct* cinfo, const uint8 uint8_t* y_plane = const_cast<uint8_t*>(dest); uint8_t* u_plane = const_cast<uint8_t*>(dest + y_plane_size); uint8_t* v_plane = const_cast<uint8_t*>(dest + y_plane_size + uv_plane_size); - std::unique_ptr<uint8_t[]> empty(new uint8_t[cinfo->image_width]); + std::unique_ptr<uint8_t[]> empty = std::make_unique<uint8_t[]>(cinfo->image_width); memset(empty.get(), 0, cinfo->image_width); const int aligned_width = ALIGNM(cinfo->image_width, kCompressBatchSize); @@ -435,7 +447,7 @@ bool JpegDecoderHelper::decompressSingleChannel(jpeg_decompress_struct* cinfo, c JSAMPARRAY planes[1] {y}; uint8_t* y_plane = const_cast<uint8_t*>(dest); - std::unique_ptr<uint8_t[]> empty(new uint8_t[cinfo->image_width]); + std::unique_ptr<uint8_t[]> empty = std::make_unique<uint8_t[]>(cinfo->image_width); memset(empty.get(), 0, cinfo->image_width); int aligned_width = ALIGNM(cinfo->image_width, kCompressBatchSize); diff --git a/libs/ultrahdr/jpegencoderhelper.cpp b/libs/ultrahdr/jpegencoderhelper.cpp index ab2f8c7b5a..a03547b538 100644 --- a/libs/ultrahdr/jpegencoderhelper.cpp +++ b/libs/ultrahdr/jpegencoderhelper.cpp @@ -107,12 +107,11 @@ bool JpegEncoderHelper::encode(const void* image, int width, int height, int jpe jpeg_write_marker(&cinfo, JPEG_APP0 + 2, static_cast<const JOCTET*>(iccBuffer), iccSize); } - if (!compress(&cinfo, static_cast<const uint8_t*>(image), isSingleChannel)) { - return false; - } + bool status = compress(&cinfo, static_cast<const uint8_t*>(image), isSingleChannel); jpeg_finish_compress(&cinfo); jpeg_destroy_compress(&cinfo); - return true; + + return status; } void JpegEncoderHelper::setJpegDestination(jpeg_compress_struct* cinfo) { @@ -174,7 +173,7 @@ bool JpegEncoderHelper::compressYuv(jpeg_compress_struct* cinfo, const uint8_t* uint8_t* y_plane = const_cast<uint8_t*>(yuv); uint8_t* u_plane = const_cast<uint8_t*>(yuv + y_plane_size); uint8_t* v_plane = const_cast<uint8_t*>(yuv + y_plane_size + uv_plane_size); - std::unique_ptr<uint8_t[]> empty(new uint8_t[cinfo->image_width]); + std::unique_ptr<uint8_t[]> empty = std::make_unique<uint8_t[]>(cinfo->image_width); memset(empty.get(), 0, cinfo->image_width); const int aligned_width = ALIGNM(cinfo->image_width, kCompressBatchSize); @@ -250,7 +249,7 @@ bool JpegEncoderHelper::compressSingleChannel(jpeg_compress_struct* cinfo, const JSAMPARRAY planes[1] {y}; uint8_t* y_plane = const_cast<uint8_t*>(image); - std::unique_ptr<uint8_t[]> empty(new uint8_t[cinfo->image_width]); + std::unique_ptr<uint8_t[]> empty = std::make_unique<uint8_t[]>(cinfo->image_width); memset(empty.get(), 0, cinfo->image_width); const int aligned_width = ALIGNM(cinfo->image_width, kCompressBatchSize); diff --git a/libs/ultrahdr/jpegr.cpp b/libs/ultrahdr/jpegr.cpp index b2bde6c485..415255d4ea 100644 --- a/libs/ultrahdr/jpegr.cpp +++ b/libs/ultrahdr/jpegr.cpp @@ -119,6 +119,13 @@ status_t JpegR::areInputArgumentsValid(jr_uncompressed_ptr uncompressed_p010_ima return ERROR_JPEGR_INVALID_INPUT_TYPE; } + if (uncompressed_p010_image->width > kMaxWidth + || uncompressed_p010_image->height > kMaxHeight) { + ALOGE("Image dimensions cannot be larger than %dx%d, image dimensions %dx%d", + kMaxWidth, kMaxHeight, uncompressed_p010_image->width, uncompressed_p010_image->height); + return ERROR_JPEGR_INVALID_INPUT_TYPE; + } + if (uncompressed_p010_image->colorGamut <= ULTRAHDR_COLORGAMUT_UNSPECIFIED || uncompressed_p010_image->colorGamut > ULTRAHDR_COLORGAMUT_MAX) { ALOGE("Unrecognized p010 color gamut %d", uncompressed_p010_image->colorGamut); @@ -726,7 +733,7 @@ status_t JpegR::generateGainMap(jr_uncompressed_ptr uncompressed_yuv_420_image, map_data.reset(reinterpret_cast<uint8_t*>(dest->data)); ColorTransformFn hdrInvOetf = nullptr; - float hdr_white_nits = 0.0f; + float hdr_white_nits = kSdrWhiteNits; switch (hdr_tf) { case ULTRAHDR_TF_LINEAR: hdrInvOetf = identityConversion; @@ -1067,6 +1074,12 @@ status_t JpegR::appendGainMap(jr_compressed_ptr compressed_jpeg_image, return ERROR_JPEGR_INVALID_NULL_PTR; } + if (metadata->minContentBoost < 1.0f || metadata->maxContentBoost < metadata->minContentBoost) { + ALOGE("received bad value for content boost min %f, max %f", metadata->minContentBoost, + metadata->maxContentBoost); + return ERROR_JPEGR_INVALID_INPUT_TYPE; + } + const string nameSpace = "http://ns.adobe.com/xap/1.0/"; const int nameSpaceLength = nameSpace.size() + 1; // need to count the null terminator diff --git a/libs/ultrahdr/multipictureformat.cpp b/libs/ultrahdr/multipictureformat.cpp index 7a265c61b7..f1679ef1b3 100644 --- a/libs/ultrahdr/multipictureformat.cpp +++ b/libs/ultrahdr/multipictureformat.cpp @@ -30,7 +30,7 @@ size_t calculateMpfSize() { sp<DataStruct> generateMpf(int primary_image_size, int primary_image_offset, int secondary_image_size, int secondary_image_offset) { size_t mpf_size = calculateMpfSize(); - sp<DataStruct> dataStruct = new DataStruct(mpf_size); + sp<DataStruct> dataStruct = sp<DataStruct>::make(mpf_size); dataStruct->write(static_cast<const void*>(kMpfSig), sizeof(kMpfSig)); #if USE_BIG_ENDIAN |