dany/libwebp
1
0
Fork 0
mirror of https://github.com/webmproject/libwebp.git synced 2025-02-13 15:32:53 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge "dec: validate colorspace before using as array index"

Browse Source
This commit is contained in:
pascal massimino 2011-11-17 10:24:59 -08:00 committed by Gerrit Code Review
commit 059f03ef99
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
src/dec/buffer.c
View File

@ -23,12 +23,21 @@ extern "C" {
// Number of bytes per pixel for the different color-spaces.
static const int kModeBpp[MODE_LAST] = { 3, 4, 3, 4, 4, 2, 2, 1, 1 };
// Check that webp_csp_mode is within the bounds of WEBP_CSP_MODE.
// Convert to an integer to handle both the unsigned/signed enum cases
// without the need for casting to remove type limit warnings.
static int IsValidColorspace(int webp_csp_mode) {
return (webp_csp_mode >= MODE_RGB && webp_csp_mode < MODE_LAST);
}
static VP8StatusCode CheckDecBuffer(const WebPDecBuffer* const buffer) {
int ok = 1;
WEBP_CSP_MODE mode = buffer->colorspace;
const int width = buffer->width;
const int height = buffer->height;
if (mode >= MODE_YUV) { // YUV checks
if (!IsValidColorspace(mode)) {
ok = 0;
} else if (mode >= MODE_YUV) { // YUV checks
const WebPYUVABuffer* const buf = &buffer->u.YUVA;
const int size = buf->y_stride * height;
const int u_size = buf->u_stride * ((height + 1) / 2);
@ -56,7 +65,7 @@ static VP8StatusCode AllocateBuffer(WebPDecBuffer* const buffer) {
const int w = buffer->width;
const int h = buffer->height;
if (w <= 0 || h <= 0) {
if (w <= 0 || h <= 0 || !IsValidColorspace(buffer->colorspace)) {
return VP8_STATUS_INVALID_PARAM;
}