Star6
133
代码
代码
Issues72
Pull Requests45
项目讨论
Wiki
分析
Star6
133
已合并
AI告警处理 20260707 #5640
he-guangyao创建于 7月7日
AI告警处理 20260707 #5640
已合并
he-guangyao创建于 7月7日
从he-guangyao/multimedia_image_framework_2026fix_AIcodecheck_20260707_new合入到openharmony/multimedia_image_frameworkmaster
共 5 个文件变更+37-10
Mframeworks/innerkitsimpl/stream/src/file_source_stream.cpp+2-1
@@ -378,6 +378,7 @@ uint8_t *FileSourceStream::GetDataPtr(bool populate)
378#ifdef SUPPORT_MMAP378#ifdef SUPPORT_MMAP
379 CHECK_ERROR_RETURN_RET(filePtr_ == nullptr, nullptr);379 CHECK_ERROR_RETURN_RET(filePtr_ == nullptr, nullptr);
380 CHECK_ERROR_RETURN_RET(!DupFd(filePtr_, mmapFd_), nullptr);380 CHECK_ERROR_RETURN_RET(!DupFd(filePtr_, mmapFd_), nullptr);
381+ CHECK_ERROR_RETURN_RET(fileSize_ < fileOriginalOffset_, nullptr);
381 auto mmptr = ::mmap(nullptr, fileSize_ - fileOriginalOffset_, PROT_READ,382 auto mmptr = ::mmap(nullptr, fileSize_ - fileOriginalOffset_, PROT_READ,
382 populate ? MAP_SHARED | MAP_POPULATE : MAP_SHARED, mmapFd_, fileOriginalOffset_);383 populate ? MAP_SHARED | MAP_POPULATE : MAP_SHARED, mmapFd_, fileOriginalOffset_);
383 if (mmptr == MAP_FAILED) {384 if (mmptr == MAP_FAILED) {
@@ -401,7 +402,7 @@ void FileSourceStream::ResetReadBuffer()
401 free(readBuffer_);402 free(readBuffer_);
402 readBuffer_ = nullptr;403 readBuffer_ = nullptr;
403 }404 }
404- if (fileData_ != nullptr && !mmapFdPassedOn_ && useMmap_) {405+ if (fileData_ != nullptr && !mmapFdPassedOn_ && useMmap_ && fileOriginalOffset_ <= fileSize_) {
405#ifdef SUPPORT_MMAP406#ifdef SUPPORT_MMAP
406 ::munmap(fileData_, fileSize_ - fileOriginalOffset_);407 ::munmap(fileData_, fileSize_ - fileOriginalOffset_);
407 fdsan_close_with_tag(mmapFd_, FILE_SOURCE_FDSAN_TAG);408 fdsan_close_with_tag(mmapFd_, FILE_SOURCE_FDSAN_TAG);
Mframeworks/kits/ani/native/src/image_ani_utils.cpp+9-3
@@ -282,8 +282,10 @@ ani_object ImageAniUtils::CreateAniPixelMap(ani_env* env, std::unique_ptr<PixelM
282 return nullptr;282 return nullptr;
283 }283 }
284 ani_object aniValue;284 ani_object aniValue;
285- if (ANI_OK != env->Object_New(cls, ctor, &aniValue, reinterpret_cast<ani_long>(pPixelMapAni.release()))) {285+ PixelMapAni* rawPtr = pPixelMapAni.release();
286+ if (ANI_OK != env->Object_New(cls, ctor, &aniValue, reinterpret_cast<ani_long>(rawPtr))) {
286 IMAGE_LOGE("New Context Fail");287 IMAGE_LOGE("New Context Fail");
288+ delete rawPtr;
287 }289 }
288 return aniValue;290 return aniValue;
289}291}
@@ -304,8 +306,10 @@ ani_object ImageAniUtils::CreateAniImageSource(ani_env* env, std::unique_ptr<Ima
304 }306 }
305 307 
306 ani_object aniValue;308 ani_object aniValue;
307- if (ANI_OK != env->Object_New(cls, ctor, &aniValue, reinterpret_cast<ani_long>(pImageSourceAni.release()))) {309+ ImageSourceAni* rawPtr = pImageSourceAni.release();
310+ if (ANI_OK != env->Object_New(cls, ctor, &aniValue, reinterpret_cast<ani_long>(rawPtr))) {
308 IMAGE_LOGE("New Context Fail");311 IMAGE_LOGE("New Context Fail");
312+ delete rawPtr;
309 }313 }
310 return aniValue;314 return aniValue;
311}315}
@@ -324,8 +328,10 @@ ani_object ImageAniUtils::CreateAniPicture(ani_env* env, std::unique_ptr<Picture
324 return nullptr;328 return nullptr;
325 }329 }
326 ani_object aniValue;330 ani_object aniValue;
327- if (ANI_OK != env->Object_New(cls, ctor, &aniValue, reinterpret_cast<ani_long>(pPictureAni.release()))) {331+ PictureAni* rawPtr = pPictureAni.release();
332+ if (ANI_OK != env->Object_New(cls, ctor, &aniValue, reinterpret_cast<ani_long>(rawPtr))) {
328 IMAGE_LOGE("New Context Fail");333 IMAGE_LOGE("New Context Fail");
334+ delete rawPtr;
329 }335 }
330 return aniValue;336 return aniValue;
331}337}
Mframeworks/kits/js/common/image_mdk_kits.cpp+15-4
@@ -53,6 +53,10 @@ static int32_t ImageNapiClipRect(ImageNapi* native, struct ImageNapiArgs* args)
53 return IMAGE_RESULT_JNI_ENV_ABNORMAL;53 return IMAGE_RESULT_JNI_ENV_ABNORMAL;
54 }54 }
55 55 
56+ if (args->outRect == nullptr) {
57+ return IMAGE_RESULT_JNI_ENV_ABNORMAL;
58+ }
59+ 
56 if (nativeImage->GetSize(args->outRect->width, args->outRect->height) != NUM_0) {60 if (nativeImage->GetSize(args->outRect->width, args->outRect->height) != NUM_0) {
57 return IMAGE_RESULT_JNI_ENV_ABNORMAL;61 return IMAGE_RESULT_JNI_ENV_ABNORMAL;
58 }62 }
@@ -69,6 +73,10 @@ static int32_t ImageNapiSize(ImageNapi* native, struct ImageNapiArgs* args)
69 return IMAGE_RESULT_BAD_PARAMETER;73 return IMAGE_RESULT_BAD_PARAMETER;
70 }74 }
71 75 
76+ if (args->outSize == nullptr) {
77+ return IMAGE_RESULT_BAD_PARAMETER;
78+ }
79+ 
72 if (nativeImage->GetSize(args->outSize->width, args->outSize->height) != NUM_0) {80 if (nativeImage->GetSize(args->outSize->width, args->outSize->height) != NUM_0) {
73 return IMAGE_RESULT_BAD_PARAMETER;81 return IMAGE_RESULT_BAD_PARAMETER;
74 }82 }
@@ -85,6 +93,9 @@ static int32_t ImageNapiFormat(ImageNapi* native, struct ImageNapiArgs* args)
85 if (nativeImage->GetFormat(format) != NUM_0) {93 if (nativeImage->GetFormat(format) != NUM_0) {
86 return IMAGE_RESULT_BAD_PARAMETER;94 return IMAGE_RESULT_BAD_PARAMETER;
87 }95 }
96+ if (args->outNum0 == nullptr) {
97+ return IMAGE_RESULT_BAD_PARAMETER;
98+ }
88 *(args->outNum0) = format;99 *(args->outNum0) = format;
89 return IMAGE_RESULT_SUCCESS;100 return IMAGE_RESULT_SUCCESS;
90}101}
@@ -142,10 +153,10 @@ ImageNapi* ImageNapi_Unwrap(napi_env env, napi_value value)
142 if (valueType != napi_object) {153 if (valueType != napi_object) {
143 return nullptr;154 return nullptr;
144 }155 }
145- std::unique_ptr<ImageNapi> imageNapi = nullptr;156+ ImageNapi* rawNapi = nullptr;
146- napi_status status = napi_unwrap(env, value, reinterpret_cast<void**>(&imageNapi));157+ napi_status status = napi_unwrap(env, value, reinterpret_cast<void**>(&rawNapi));
147- if ((status == napi_ok) && imageNapi != nullptr) {158+ if ((status == napi_ok) && rawNapi != nullptr) {
148- return imageNapi.release();159+ return rawNapi;
149 }160 }
150 return nullptr;161 return nullptr;
151}162}
Mframeworks/kits/taihe/src/image_creator_taihe.cpp+8-2
@@ -243,7 +243,12 @@ void ImageCreatorImpl::QueueImageSync(weak::Image image)
243 return std::monostate{};243 return std::monostate{};
244 };244 };
245 245 
246- auto imageImpl = reinterpret_cast<ImageImpl*>(image->GetImplPtr());246+ auto imageImplPtr = image->GetImplPtr();
247+ if (imageImplPtr == 0) {
248+ IMAGE_LOGE("QueueImageSync: imageImplPtr is null");
249+ return;
250+ }
251+ auto imageImpl = reinterpret_cast<ImageImpl*>(imageImplPtr);
247 QueueImageSyncProcess(args, imageImpl, this);252 QueueImageSyncProcess(args, imageImpl, this);
248}253}
249 254 
@@ -361,7 +366,8 @@ void ImageCreatorImpl::OnImageRelease(::taihe::callback_view<void(uintptr_t, uin
361 std::shared_ptr<ImageCreatorReleaseListener> listener = std::make_shared<ImageCreatorReleaseListener>();366 std::shared_ptr<ImageCreatorReleaseListener> listener = std::make_shared<ImageCreatorReleaseListener>();
362 listener->context = context;367 listener->context = context;
363 368 
364- native->RegisterBufferReleaseListener((std::shared_ptr<OHOS::Media::SurfaceBufferReleaseListener> &)listener);369+ native->RegisterBufferReleaseListener(
370+ std::static_pointer_cast<OHOS::Media::SurfaceBufferReleaseListener>(listener));
365 371 
366 listener->context->status = OHOS::Media::SUCCESS;372 listener->context->status = OHOS::Media::SUCCESS;
367 return std::monostate{};373 return std::monostate{};
Mplugins/common/libs/image/libextplugin/src/ext_encoder.cpp+3-0
@@ -3019,6 +3019,9 @@ static bool FillImagePropertyItem(const std::shared_ptr<AbsMemory> &mem, const s
3019 int payloadIntSize = static_cast<int>(payloadSize);3019 int payloadIntSize = static_cast<int>(payloadSize);
3020 size_t typeSize = sizeof(type);3020 size_t typeSize = sizeof(type);
3021 size_t intSize = sizeof(int);3021 size_t intSize = sizeof(int);
3022+ size_t totalSize = typeSize + intSize + payloadSize;
3023+ cond = (offset >= memSize) || (totalSize > memSize - offset);
3024+ CHECK_INFO_RETURN_RET_LOG(cond, false, "FillImagePropertyItem offset or size overflow");
3022 bool res = (memcpy_s(memData + offset, memSize - offset, &type, typeSize) == EOK) &&3025 bool res = (memcpy_s(memData + offset, memSize - offset, &type, typeSize) == EOK) &&
3023 (memcpy_s(memData + offset + typeSize, memSize - offset - typeSize, &payloadIntSize, intSize) == EOK) &&3026 (memcpy_s(memData + offset + typeSize, memSize - offset - typeSize, &payloadIntSize, intSize) == EOK) &&
3024 (memcpy_s(memData + offset + typeSize + intSize, memSize - offset - typeSize - intSize,3027 (memcpy_s(memData + offset + typeSize + intSize, memSize - offset - typeSize - intSize,