dany/libwebp
1
0
Fork 0
mirror of https://github.com/webmproject/libwebp.git synced 2025-02-13 15:32:53 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge "dec: validate colorspace before using as array index"

Browse Source
This commit is contained in:
pascal massimino 2011-11-17 10:24:59 -08:00 committed by Gerrit Code Review
commit 059f03ef99
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/dec/buffer.c
View File

@ -23,12 +23,21 @@ extern "C" {
// Number of bytes per pixel for the different color-spaces. // Number of bytes per pixel for the different color-spaces.
static const int kModeBpp[MODE_LAST] = { 3, 4, 3, 4, 4, 2, 2, 1, 1 }; static const int kModeBpp[MODE_LAST] = { 3, 4, 3, 4, 4, 2, 2, 1, 1 };
// Check that webp_csp_mode is within the bounds of WEBP_CSP_MODE.
// Convert to an integer to handle both the unsigned/signed enum cases
// without the need for casting to remove type limit warnings.
static int IsValidColorspace(int webp_csp_mode) {
return (webp_csp_mode >= MODE_RGB && webp_csp_mode < MODE_LAST);
}
static VP8StatusCode CheckDecBuffer(const WebPDecBuffer* const buffer) { static VP8StatusCode CheckDecBuffer(const WebPDecBuffer* const buffer) {
int ok = 1; int ok = 1;
WEBP_CSP_MODE mode = buffer->colorspace; WEBP_CSP_MODE mode = buffer->colorspace;
const int width = buffer->width; const int width = buffer->width;
const int height = buffer->height; const int height = buffer->height;
if (mode >= MODE_YUV) { // YUV checks if (!IsValidColorspace(mode)) {
ok = 0;
} else if (mode >= MODE_YUV) { // YUV checks
const WebPYUVABuffer* const buf = &buffer->u.YUVA; const WebPYUVABuffer* const buf = &buffer->u.YUVA;
const int size = buf->y_stride * height; const int size = buf->y_stride * height;
const int u_size = buf->u_stride * ((height + 1) / 2); const int u_size = buf->u_stride * ((height + 1) / 2);
@ -56,7 +65,7 @@ static VP8StatusCode AllocateBuffer(WebPDecBuffer* const buffer) {
const int w = buffer->width; const int w = buffer->width;
const int h = buffer->height; const int h = buffer->height;
if (w <= 0 || h <= 0) { if (w <= 0 || h <= 0 || !IsValidColorspace(buffer->colorspace)) {
return VP8_STATUS_INVALID_PARAM; return VP8_STATUS_INVALID_PARAM;
} }