Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fix heap buffer overflow in a pixel format conversion function
Summary: Fixes a loop control logic in `FrameConverter::convertTwoRows_1PlaneMosaicPacked10Bit_To_1PlaneUnpacked3Channels8BitAdvanced()` Setting loop limit to `width - 5u` when `width` is `4u` resulted in loop limit being set to unsigned integer's maximum value due to unsigned integer arithmetic. This caused the loop to iterate and read/write past buffer boundaries. Reviewed By: ASchneiderMeta Differential Revision: D59763520 fbshipit-source-id: 1350c3651c48932bee5f7d6cbfe4a3a3f94406e6
- Loading branch information