Bilinear scale up msan fix

- Avoid stepping to height + 1 for bilinear filter 2nd row for last row of source
- Box filter ubsan fix for 3/4 and 3/8 scaling for 16 bit planar
- Height 1 asan fixes

Bug: libyuv:935, b/206716399
Change-Id: I56088520f2a884a37b987ee5265def175047673e
Reviewed-on: https://chromium-review.googlesource.com/c/libyuv/libyuv/+/3717263
Reviewed-by: Wan-Teh Chang <wtc@google.com>
Commit-Queue: Frank Barchard <fbarchard@chromium.org>

11 files changed, 52 insertions, 32 deletions

diff --git a/README.chromium b/README.chromium
index cf0aef02..e8cc1e8d 100644
--- a/README.chromium
+++ b/README.chromium
@@ -1,6 +1,6 @@
 Name: libyuv
 URL: http://code.google.com/p/libyuv/
-Version: 1829
+Version: 1831
 License: BSD
 License File: LICENSE
 
diff --git a/include/libyuv/version.h b/include/libyuv/version.h
index dadcea51..45a200b1 100644
--- a/include/libyuv/version.h
+++ b/include/libyuv/version.h
@@ -11,6 +11,6 @@
 #ifndef INCLUDE_LIBYUV_VERSION_H_
 #define INCLUDE_LIBYUV_VERSION_H_
 
-#define LIBYUV_VERSION 1829
+#define LIBYUV_VERSION 1831
 
 #endif  // INCLUDE_LIBYUV_VERSION_H_
diff --git a/source/planar_functions.cc b/source/planar_functions.cc
index b5344862..169d4a8f 100644
--- a/source/planar_functions.cc
+++ b/source/planar_functions.cc
@@ -3809,7 +3809,7 @@ int ARGBBlur(const uint8_t* src_argb,
   if (radius > (width / 2 - 1)) {
     radius = width / 2 - 1;
   }
-  if (radius <= 0) {
+  if (radius <= 0 || height <= 1) {
     return -1;
   }
 #if defined(HAS_CUMULATIVESUMTOAVERAGEROW_SSE2)
diff --git a/source/row_common.cc b/source/row_common.cc
index 3bfc5618..2c9a35f4 100644
--- a/source/row_common.cc
+++ b/source/row_common.cc
@@ -3344,8 +3344,11 @@ void CumulativeSumToAverageRow_C(const int32_t* tl,
                                  int area,
                                  uint8_t* dst,
                                  int count) {
-  float ooa = 1.0f / area;
+  float ooa;
   int i;
+  assert(area != 0);
+
+  ooa = 1.0f / area;
   for (i = 0; i < count; ++i) {
     dst[0] = (uint8_t)((bl[w + 0] + tl[0] - bl[0] - tl[w + 0]) * ooa);
     dst[1] = (uint8_t)((bl[w + 1] + tl[1] - bl[1] - tl[w + 1]) * ooa);
diff --git a/source/row_neon.cc b/source/row_neon.cc
index 653fd203..14eed6ff 100644
--- a/source/row_neon.cc
+++ b/source/row_neon.cc
@@ -19,7 +19,8 @@ extern "C" {
 #if !defined(LIBYUV_DISABLE_NEON) && defined(__ARM_NEON__) && \
     !defined(__aarch64__)
 
-// d8-d15, r4-r11,r14(lr) need to be preserved if used. r13(sp),r15(pc) are reserved.
+// d8-d15, r4-r11,r14(lr) need to be preserved if used. r13(sp),r15(pc) are
+// reserved.
 
 // q0: Y uint16x8_t
 // d2: U uint8x8_t
@@ -2766,12 +2767,12 @@ void InterpolateRow_16_NEON(uint16_t* dst_ptr,
       "bgt         100b                          \n"
 
       "99:                                       \n"
-      : "+r"(dst_ptr),      // %0
-        "+r"(src_ptr),      // %1
-        "+r"(src_ptr1),     // %2
-        "+r"(dst_width)     // %3
-      : "r"(y1_fraction),   // %4
-        "r"(y0_fraction)    // %5
+      : "+r"(dst_ptr),     // %0
+        "+r"(src_ptr),     // %1
+        "+r"(src_ptr1),    // %2
+        "+r"(dst_width)    // %3
+      : "r"(y1_fraction),  // %4
+        "r"(y0_fraction)   // %5
       : "cc", "memory", "q0", "q1", "q2", "q3", "q8");
 }
 
diff --git a/source/row_neon64.cc b/source/row_neon64.cc
index 6a6e37ef..00adfe3e 100644
--- a/source/row_neon64.cc
+++ b/source/row_neon64.cc
@@ -3022,12 +3022,12 @@ void InterpolateRow_16_NEON(uint16_t* dst_ptr,
       "b.gt        100b                          \n"
 
       "99:                                       \n"
-      : "+r"(dst_ptr),      // %0
-        "+r"(src_ptr),      // %1
-        "+r"(src_ptr1),     // %2
-        "+r"(dst_width)     // %3
-      : "r"(y1_fraction),   // %4
-        "r"(y0_fraction)    // %5
+      : "+r"(dst_ptr),     // %0
+        "+r"(src_ptr),     // %1
+        "+r"(src_ptr1),    // %2
+        "+r"(dst_width)    // %3
+      : "r"(y1_fraction),  // %4
+        "r"(y0_fraction)   // %5
       : "cc", "memory", "v0", "v1", "v2", "v3", "v4", "v5");
 }
 
diff --git a/source/scale.cc b/source/scale.cc
index ac009310..8147c291 100644
--- a/source/scale.cc
+++ b/source/scale.cc
@@ -1327,7 +1327,9 @@ void ScalePlaneBilinearUp(int src_width,
       src += src_stride;
     }
     ScaleFilterCols(rowptr + rowstride, src, dst_width, x, dx);
-    src += src_stride;
+    if (src_height > 2) {
+      src += src_stride;
+    }
 
     for (j = 0; j < dst_height; ++j) {
       yi = y >> 16;
@@ -1342,7 +1344,9 @@ void ScalePlaneBilinearUp(int src_width,
           rowptr += rowstride;
           rowstride = -rowstride;
           lasty = yi;
-          src += src_stride;
+          if ((y + 65536) < max_y) {
+            src += src_stride;
+          }
         }
       }
       if (filtering == kFilterLinear) {
@@ -1775,7 +1779,9 @@ void ScalePlaneBilinearUp_16(int src_width,
       src += src_stride;
     }
     ScaleFilterCols(rowptr + rowstride, src, dst_width, x, dx);
-    src += src_stride;
+    if (src_height > 2) {
+      src += src_stride;
+    }
 
     for (j = 0; j < dst_height; ++j) {
       yi = y >> 16;
@@ -1790,7 +1796,9 @@ void ScalePlaneBilinearUp_16(int src_width,
           rowptr += rowstride;
           rowstride = -rowstride;
           lasty = yi;
-          src += src_stride;
+          if ((y + 65536) < max_y) {
+            src += src_stride;
+          }
         }
       }
       if (filtering == kFilterLinear) {
diff --git a/source/scale_argb.cc b/source/scale_argb.cc
index 10b5c8fe..9c3acf7f 100644
--- a/source/scale_argb.cc
+++ b/source/scale_argb.cc
@@ -560,7 +560,9 @@ static void ScaleARGBBilinearUp(int src_width,
       src += src_stride;
     }
     ScaleARGBFilterCols(rowptr + rowstride, src, dst_width, x, dx);
-    src += src_stride;
+    if (src_height > 2) {
+      src += src_stride;
+    }
 
     for (j = 0; j < dst_height; ++j) {
       yi = y >> 16;
@@ -575,7 +577,9 @@ static void ScaleARGBBilinearUp(int src_width,
           rowptr += rowstride;
           rowstride = -rowstride;
           lasty = yi;
-          src += src_stride;
+          if ((y + 65536) < max_y) {
+            src += src_stride;
+          }
         }
       }
       if (filtering == kFilterLinear) {
diff --git a/source/scale_common.cc b/source/scale_common.cc
index e0c821c2..812d57ec 100644
--- a/source/scale_common.cc
+++ b/source/scale_common.cc
@@ -766,18 +766,18 @@ void ScaleRowDown38_3_Box_16_C(const uint16_t* src_ptr,
         (src_ptr[0] + src_ptr[1] + src_ptr[2] + src_ptr[stride + 0] +
          src_ptr[stride + 1] + src_ptr[stride + 2] + src_ptr[stride * 2 + 0] +
          src_ptr[stride * 2 + 1] + src_ptr[stride * 2 + 2]) *
-            (65536 / 9) >>
+            (65536u / 9u) >>
         16;
     dst_ptr[1] =
         (src_ptr[3] + src_ptr[4] + src_ptr[5] + src_ptr[stride + 3] +
          src_ptr[stride + 4] + src_ptr[stride + 5] + src_ptr[stride * 2 + 3] +
          src_ptr[stride * 2 + 4] + src_ptr[stride * 2 + 5]) *
-            (65536 / 9) >>
+            (65536u / 9u) >>
         16;
     dst_ptr[2] =
         (src_ptr[6] + src_ptr[7] + src_ptr[stride + 6] + src_ptr[stride + 7] +
          src_ptr[stride * 2 + 6] + src_ptr[stride * 2 + 7]) *
-            (65536 / 6) >>
+            (65536u / 6u) >>
         16;
     src_ptr += 8;
     dst_ptr += 3;
@@ -820,15 +820,15 @@ void ScaleRowDown38_2_Box_16_C(const uint16_t* src_ptr,
   for (i = 0; i < dst_width; i += 3) {
     dst_ptr[0] = (src_ptr[0] + src_ptr[1] + src_ptr[2] + src_ptr[stride + 0] +
                   src_ptr[stride + 1] + src_ptr[stride + 2]) *
-                     (65536 / 6) >>
+                     (65536u / 6u) >>
                  16;
     dst_ptr[1] = (src_ptr[3] + src_ptr[4] + src_ptr[5] + src_ptr[stride + 3] +
                   src_ptr[stride + 4] + src_ptr[stride + 5]) *
-                     (65536 / 6) >>
+                     (65536u / 6u) >>
                  16;
     dst_ptr[2] =
         (src_ptr[6] + src_ptr[7] + src_ptr[stride + 6] + src_ptr[stride + 7]) *
-            (65536 / 4) >>
+            (65536u / 4u) >>
         16;
     src_ptr += 8;
     dst_ptr += 3;
diff --git a/source/scale_uv.cc b/source/scale_uv.cc
index 40f39377..3b3d7b8e 100644
--- a/source/scale_uv.cc
+++ b/source/scale_uv.cc
@@ -586,7 +586,9 @@ static void ScaleUVBilinearUp(int src_width,
       src += src_stride;
     }
     ScaleUVFilterCols(rowptr + rowstride, src, dst_width, x, dx);
-    src += src_stride;
+    if (src_height > 2) {
+      src += src_stride;
+    }
 
     for (j = 0; j < dst_height; ++j) {
       yi = y >> 16;
@@ -601,7 +603,9 @@ static void ScaleUVBilinearUp(int src_width,
           rowptr += rowstride;
           rowstride = -rowstride;
           lasty = yi;
-          src += src_stride;
+          if ((y + 65536) < max_y) {
+            src += src_stride;
+          }
         }
       }
       if (filtering == kFilterLinear) {
diff --git a/unit_test/convert_test.cc b/unit_test/convert_test.cc
index c2d95220..1f975825 100644
--- a/unit_test/convert_test.cc
+++ b/unit_test/convert_test.cc
@@ -2643,7 +2643,7 @@ TEST_F(LibYUVConvertTest, I420CropOddY) {
   const int SUBSAMP_Y = 2;
   const int kWidth = benchmark_width_;
   const int kHeight = benchmark_height_;
-  const int crop_y = 1;
+  const int crop_y = benchmark_height_ > 1 ? 1 : 0;
   const int kDestWidth = benchmark_width_;
   const int kDestHeight = benchmark_height_ - crop_y * 2;
   const int kStrideU = SUBSAMPLE(kWidth, SUBSAMP_X);