search

webmproject / sjpeg

SimpleJPEG: simple jpeg encoder
Apache License 2.0
69 stars 12 forks source link

Overflow in DCT calculation on NEON #128

Closed same-denik closed 1 week ago

same-denik commented 2 weeks ago

Large coefficients can cause an overflow in Horizontal pass of Dct_NEON transformation. Consider input coeffs = { 128, 128, 128, 128, 128, 128, 128, 128, ...}. Vertical pass produces { 8192, 8192, 8192, 8192, 8192, 8192, 8192, 8192, ..} and 2 consecutive butterfly operations on the first row leads to an overflow of c0 = -32768.

jzern commented 2 weeks ago

cc: @skal65535

Thanks for the report. Are you running into this in practice? Do you have an input file that shows the issue?

same-denik commented 2 weeks ago

Yes, this bug was revealed in a Google internal project and showed up only on NEON. SSE version doesn't do a second butterfly and hence no overflow there. Let me see if I can narrow down the test into a small reproducible.

I'm about to send a pull request with the fix.

jzern commented 2 weeks ago

Yes, this bug was revealed in a Google internal project and showed up only on NEON. SSE version doesn't do a second butterfly and hence no overflow there. Let me see if I can narrow down the test into a small reproducible.

Thanks. If you need to share anything proprietary you can use the internal component 43540.