dany/libwebp
1
0
Fork 0
mirror of https://github.com/webmproject/libwebp.git synced 2024-12-28 06:38:20 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix alpha-filtering crash when image width is larger than radius

Browse Source 
(we also limit radius based on height too, for good measure, although it's not an asan bug)

fixes oss-fuzz issue #9105

BUG=webp:512

Change-Id: Ie0d79dd81480dc4e2b653b7e992e5cdcd3dfa834
(cherry picked from commit 1344a2e947)
(cherry picked from commit 61ff26aeeb)
This commit is contained in:
Pascal Massimino 2018-06-29 10:15:47 -07:00 committed by James Zern
parent 47768596f6
commit 2ccbb406e1
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/utils/quant_levels_dec_utils.c
View File

@ -261,9 +261,15 @@ static void CleanupParams(SmoothParams* const p) {
int WebPDequantizeLevels(uint8_t* const data, int width, int height, int stride, int WebPDequantizeLevels(uint8_t* const data, int width, int height, int stride,
int strength) { int strength) {
const int radius = 4 * strength / 100; int radius = 4 * strength / 100;
if (strength < 0 || strength > 100) return 0; if (strength < 0 || strength > 100) return 0;
if (data == NULL || width <= 0 || height <= 0) return 0; // bad params if (data == NULL || width <= 0 || height <= 0) return 0; // bad params
// limit the filter size to not exceed the image dimensions
if (2 * radius + 1 > width) radius = (width - 1) >> 1;
if (2 * radius + 1 > height) radius = (height - 1) >> 1;
if (radius > 0) { if (radius > 0) {
SmoothParams p; SmoothParams p;
memset(&p, 0, sizeof(p)); memset(&p, 0, sizeof(p));