dany/libwebp
1
0
Fork 0
mirror of https://github.com/webmproject/libwebp.git synced 2024-12-27 06:08:21 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix invalid check for buffer size

Browse Source 
BUG=webp:383,webp:512

Change-Id: I8ebbb5ca4860d73c3b59b12e238b54a89184bed0
(cherry picked from commit 71ed73cf86)
(cherry picked from commit dad31750e3)
This commit is contained in:
Pascal Massimino 2018-05-25 13:25:39 +02:00 committed by James Zern
parent 1f14632a18
commit 16fc937d2e
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/dec/buffer_dec.c
View File

@ -74,7 +74,8 @@ static VP8StatusCode CheckDecBuffer(const WebPDecBuffer* const buffer) {
} else { // RGB checks } else { // RGB checks
const WebPRGBABuffer* const buf = &buffer->u.RGBA; const WebPRGBABuffer* const buf = &buffer->u.RGBA;
const int stride = abs(buf->stride); const int stride = abs(buf->stride);
const uint64_t size = MIN_BUFFER_SIZE(width, height, stride); const uint64_t size =
MIN_BUFFER_SIZE(width * kModeBpp[mode], height, stride);
ok &= (size <= buf->size); ok &= (size <= buf->size);
ok &= (stride >= width * kModeBpp[mode]); ok &= (stride >= width * kModeBpp[mode]);
ok &= (buf->rgba != NULL); ok &= (buf->rgba != NULL);