diff --git a/frameworks/native/efilter/filterimpl/brightness/cpu_brightness_algo.cpp b/frameworks/native/efilter/filterimpl/brightness/cpu_brightness_algo.cpp index eea9dd6de7c6b7adbab00a3876a33f6e8cbe461b..3dc207503eaa2e7337248758d66de93108f830b7 100644 --- a/frameworks/native/efilter/filterimpl/brightness/cpu_brightness_algo.cpp +++ b/frameworks/native/efilter/filterimpl/brightness/cpu_brightness_algo.cpp @@ -95,7 +95,11 @@ ErrorCode CpuBrightnessAlgo::OnApplyRGBA8888(EffectBuffer *src, EffectBuffer *ds uint32_t srcRowStride = src->bufferInfo_->rowStride_; uint32_t dstRowStride = dst->bufferInfo_->rowStride_; - + + if (srcRowStride * height + width * BYTES_PER_INT + BYTES_PER_INT > dst->bufferInfo_->len_ || + dstRowStride * height + width * BYTES_PER_INT + BYTES_PER_INT > src->bufferInfo_->len_) { + return ErrorCode::ERR_INVALID_PARAMETER_VALUE; + } #pragma omp parallel for default(none) shared(height, width, dstRgb, srcRgb, lut, srcRowStride, dstRowStride) for (uint32_t y = 0; y < height; ++y) { for (uint32_t x = 0; x < width; ++x) { diff --git a/frameworks/native/efilter/filterimpl/contrast/cpu_contrast_algo.cpp b/frameworks/native/efilter/filterimpl/contrast/cpu_contrast_algo.cpp index 16a880626fbe6ed1b494a4cb3c15151c0df31ae8..6603e0e1052ec8836529ca25e9f85aa744bb6317 100644 --- a/frameworks/native/efilter/filterimpl/contrast/cpu_contrast_algo.cpp +++ b/frameworks/native/efilter/filterimpl/contrast/cpu_contrast_algo.cpp @@ -85,7 +85,11 @@ ErrorCode CpuContrastAlgo::OnApplyRGBA8888(EffectBuffer *src, EffectBuffer *dst, uint32_t srcRowStride = src->bufferInfo_->rowStride_; uint32_t dstRowStride = dst->bufferInfo_->rowStride_; - + + if (srcRowStride * height + width * BYTES_PER_INT + BYTES_PER_INT > dst->bufferInfo_->len_ || + dstRowStride * height + width * BYTES_PER_INT + BYTES_PER_INT > src->bufferInfo_->len_) { + return ErrorCode::ERR_INVALID_PARAMETER_VALUE; + } #pragma omp parallel for default(none) shared(height, width, dstRgb, srcRgb, lut, srcRowStride, dstRowStride) for (uint32_t y = 0; y < height; ++y) { for (uint32_t x = 0; x < width; ++x) {