liz/rawTherapee
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Buffer overrun in Amaze demosaic when image width is odd, Issue 2203

Browse Source
This commit is contained in:
Ingo
2014-01-16 22:17:47 +01:00
parent 248cf3bcde
commit 90bf4712fa
1 changed files with 31 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
rtengine/amaze_demosaic_RT.cc
View File

@@ -296,12 +296,20 @@ SSEFUNCTION void RawImageSource::amaze_demosaic_RT(int winx, int winy, int winw,
const __m128 c65535v = _mm_set1_ps( 65535.0f ); const __m128 c65535v = _mm_set1_ps( 65535.0f );
__m128 tempv; __m128 tempv;
for (rr=rrmin; rr < rrmax; rr++){ for (rr=rrmin; rr < rrmax; rr++){
for (row=rr+top, cc=ccmin; cc < ccmax; cc+=4) { for (row=rr+top, cc=ccmin; cc < ccmax-3; cc+=4) {
indx1=rr*TS+cc; indx1=rr*TS+cc;
tempv = LVFU(rawData[row][cc+left]) / c65535v; tempv = LVFU(rawData[row][cc+left]) / c65535v;
_mm_store_ps( &cfa[indx1], tempv ); _mm_store_ps( &cfa[indx1], tempv );
_mm_store_ps( &rgbgreen[indx1], tempv ); _mm_store_ps( &rgbgreen[indx1], tempv );
} }
for (; cc < ccmax; cc++) {
indx1=rr*TS+cc;
cfa[indx1] = (rawData[row][cc+left])/65535.0f;
if(FC(rr,cc)==1)
rgbgreen[indx1] = cfa[indx1];
}
} }
// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
//fill borders //fill borders
@@ -1308,8 +1316,8 @@ SSEFUNCTION void RawImageSource::amaze_demosaic_RT(int winx, int winy, int winw,
#endif #endif
float temp; float temp;
for (rr=16; rr<rr1-16; rr++) { for (rr=16; rr<rr1-16; rr++) {
if((FC(rr,2)&1)==1) if((FC(rr,2)&1)==1) {
for (cc=16,indx=rr*TS+cc,row=rr+top; cc<cc1-16; cc+=2,indx++) { for (cc=16,indx=rr*TS+cc,row=rr+top; cc<cc1-16-(cc1&1); cc+=2,indx++) {
col = cc + left; col = cc + left;
temp = 1.0f/((hvwt[(indx-v1)>>1])+(1.0f-hvwt[(indx+1)>>1])+(1.0f-hvwt[(indx-1)>>1])+(hvwt[(indx+v1)>>1])); temp = 1.0f/((hvwt[(indx-v1)>>1])+(1.0f-hvwt[(indx+1)>>1])+(1.0f-hvwt[(indx-1)>>1])+(hvwt[(indx+v1)>>1]));
red[row][col]=65535.0f*(rgbgreen[indx]- ((hvwt[(indx-v1)>>1])*Dgrb[0][(indx-v1)>>1]+(1.0f-hvwt[(indx+1)>>1])*Dgrb[0][(indx+1)>>1]+(1.0f-hvwt[(indx-1)>>1])*Dgrb[0][(indx-1)>>1]+(hvwt[(indx+v1)>>1])*Dgrb[0][(indx+v1)>>1])* red[row][col]=65535.0f*(rgbgreen[indx]- ((hvwt[(indx-v1)>>1])*Dgrb[0][(indx-v1)>>1]+(1.0f-hvwt[(indx+1)>>1])*Dgrb[0][(indx+1)>>1]+(1.0f-hvwt[(indx-1)>>1])*Dgrb[0][(indx-1)>>1]+(hvwt[(indx+v1)>>1])*Dgrb[0][(indx+v1)>>1])*
@@ -1322,11 +1330,21 @@ SSEFUNCTION void RawImageSource::amaze_demosaic_RT(int winx, int winy, int winw,
red[row][col]=65535.0f*(rgbgreen[indx]-Dgrb[0][indx>>1]); red[row][col]=65535.0f*(rgbgreen[indx]-Dgrb[0][indx>>1]);
blue[row][col]=65535.0f*(rgbgreen[indx]-Dgrb[1][indx>>1]); blue[row][col]=65535.0f*(rgbgreen[indx]-Dgrb[1][indx>>1]);
} }
else if(cc1&1) { // width of tile is odd
for (cc=16,indx=rr*TS+cc,row=rr+top; cc<cc1-16; cc+=2,indx++) { col = cc + left;
temp = 1.0f/((hvwt[(indx-v1)>>1])+(1.0f-hvwt[(indx+1)>>1])+(1.0f-hvwt[(indx-1)>>1])+(hvwt[(indx+v1)>>1]));
red[row][col]=65535.0f*(rgbgreen[indx]- ((hvwt[(indx-v1)>>1])*Dgrb[0][(indx-v1)>>1]+(1.0f-hvwt[(indx+1)>>1])*Dgrb[0][(indx+1)>>1]+(1.0f-hvwt[(indx-1)>>1])*Dgrb[0][(indx-1)>>1]+(hvwt[(indx+v1)>>1])*Dgrb[0][(indx+v1)>>1])*
temp);
blue[row][col]=65535.0f*(rgbgreen[indx]- ((hvwt[(indx-v1)>>1])*Dgrb[1][(indx-v1)>>1]+(1.0f-hvwt[(indx+1)>>1])*Dgrb[1][(indx+1)>>1]+(1.0f-hvwt[(indx-1)>>1])*Dgrb[1][(indx-1)>>1]+(hvwt[(indx+v1)>>1])*Dgrb[1][(indx+v1)>>1])*
temp);
}
}
else {
for (cc=16,indx=rr*TS+cc,row=rr+top; cc<cc1-16-(cc1&1); cc+=2,indx++) {
col = cc + left; col = cc + left;
red[row][col]=65535.0f*(rgbgreen[indx]-Dgrb[0][indx>>1]); red[row][col]=65535.0f*(rgbgreen[indx]-Dgrb[0][indx>>1]);
blue[row][col]=65535.0f*(rgbgreen[indx]-Dgrb[1][indx>>1]); blue[row][col]=65535.0f*(rgbgreen[indx]-Dgrb[1][indx>>1]);
indx++; indx++;
col++; col++;
temp = 1.0f/((hvwt[(indx-v1)>>1])+(1.0f-hvwt[(indx+1)>>1])+(1.0f-hvwt[(indx-1)>>1])+(hvwt[(indx+v1)>>1])); temp = 1.0f/((hvwt[(indx-v1)>>1])+(1.0f-hvwt[(indx+1)>>1])+(1.0f-hvwt[(indx-1)>>1])+(hvwt[(indx+v1)>>1]));
@@ -1334,9 +1352,15 @@ SSEFUNCTION void RawImageSource::amaze_demosaic_RT(int winx, int winy, int winw,
temp); temp);
blue[row][col]=65535.0f*(rgbgreen[indx]- ((hvwt[(indx-v1)>>1])*Dgrb[1][(indx-v1)>>1]+(1.0f-hvwt[(indx+1)>>1])*Dgrb[1][(indx+1)>>1]+(1.0f-hvwt[(indx-1)>>1])*Dgrb[1][(indx-1)>>1]+(hvwt[(indx+v1)>>1])*Dgrb[1][(indx+v1)>>1])* blue[row][col]=65535.0f*(rgbgreen[indx]- ((hvwt[(indx-v1)>>1])*Dgrb[1][(indx-v1)>>1]+(1.0f-hvwt[(indx+1)>>1])*Dgrb[1][(indx+1)>>1]+(1.0f-hvwt[(indx-1)>>1])*Dgrb[1][(indx-1)>>1]+(hvwt[(indx+v1)>>1])*Dgrb[1][(indx+v1)>>1])*
temp); temp);
}
if(cc1&1) { // width of tile is odd
col = cc + left;
red[row][col]=65535.0f*(rgbgreen[indx]-Dgrb[0][indx>>1]);
blue[row][col]=65535.0f*(rgbgreen[indx]-Dgrb[1][indx>>1]);
}
}
}
}
}
// %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%