From 16fc937d2e1cddccd794e00483ea91c06f129015 Mon Sep 17 00:00:00 2001
From: Pascal Massimino <pascal.massimino@gmail.com>
Date: Fri, 25 May 2018 13:25:39 +0200
Subject: [PATCH] fix invalid check for buffer size

BUG=webp:383,webp:512

Change-Id: I8ebbb5ca4860d73c3b59b12e238b54a89184bed0
(cherry picked from commit 71ed73cf86132394ea25ae9c7ed431e0d71043f5)
(cherry picked from commit dad31750e374eff8e02fb467eb562d4bf236ed6e)
---
 src/dec/buffer_dec.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/dec/buffer_dec.c b/src/dec/buffer_dec.c
index 75eb3c40..3cd94eb4 100644
--- a/src/dec/buffer_dec.c
+++ b/src/dec/buffer_dec.c
@@ -74,7 +74,8 @@ static VP8StatusCode CheckDecBuffer(const WebPDecBuffer* const buffer) {
   } else {    // RGB checks
     const WebPRGBABuffer* const buf = &buffer->u.RGBA;
     const int stride = abs(buf->stride);
-    const uint64_t size = MIN_BUFFER_SIZE(width, height, stride);
+    const uint64_t size =
+        MIN_BUFFER_SIZE(width * kModeBpp[mode], height, stride);
     ok &= (size <= buf->size);
     ok &= (stride >= width * kModeBpp[mode]);
     ok &= (buf->rgba != NULL);