dany/libwebp
1
0
Fork 0
mirror of https://github.com/webmproject/libwebp.git synced 2024-12-26 05:38:22 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix signed integer overflows.

Browse Source 
Change-Id: I62c9949f0edac58d69d991d6be5f85ae9e4d62a9
This commit is contained in:
Vincent Rabaud 2017-08-31 11:56:28 +02:00
parent f66f94ef36
commit 3993af127e
4 changed files with 16 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/dec/buffer_dec.c
View File

@ -98,9 +98,14 @@ static VP8StatusCode AllocateBuffer(WebPDecBuffer* const buffer) {
uint64_t uv_size = 0, a_size = 0, total_size;
// We need memory and it hasn't been allocated yet.
// => initialize output buffer, now that dimensions are known.
const int stride = w * kModeBpp[mode];
const uint64_t size = (uint64_t)stride * h;
int stride;
uint64_t size;
if ((uint64_t)w * kModeBpp[mode] >= (1ull << 32)) {
return VP8_STATUS_INVALID_PARAM;
}
stride = w * kModeBpp[mode];
size = (uint64_t)stride * h;
if (!WebPIsRGBMode(mode)) {
uv_stride = (w + 1) / 2;
uv_size = (uint64_t)uv_stride * ((h + 1) / 2);

8
src/enc/picture_enc.c
View File

@ -92,8 +92,8 @@ int WebPPictureAllocYUVA(WebPPicture* const picture, int width, int height) {
(WebPEncCSP)((int)picture->colorspace & WEBP_CSP_UV_MASK);
const int has_alpha = (int)picture->colorspace & WEBP_CSP_ALPHA_BIT;
const int y_stride = width;
const int uv_width = (width + 1) >> 1;
const int uv_height = (height + 1) >> 1;
const int uv_width = (int)(((int64_t)width + 1) >> 1);
const int uv_height = (int)(((int64_t)height + 1) >> 1);
const int uv_stride = uv_width;
int a_width, a_stride;
uint64_t y_size, uv_size, a_size, total_size;
@ -118,8 +118,8 @@ int WebPPictureAllocYUVA(WebPPicture* const picture, int width, int height) {
total_size = y_size + a_size + 2 * uv_size;
// Security and validation checks
if (width <= 0 || height <= 0 || // luma/alpha param error
uv_width < 0 || uv_height < 0) { // u/v param error
if (width <= 0 || height <= 0 || // luma/alpha param error
uv_width <= 0 || uv_height <= 0) { // u/v param error
return WebPEncodingSetError(picture, VP8_ENC_ERROR_BAD_DIMENSION);
}
// allocate a new buffer.

2
src/enc/quant_enc.c
View File

@ -1162,7 +1162,7 @@ static void RefineUsingDistortion(VP8EncIterator* const it,
const uint8_t* const src = it->yuv_in_ + Y_OFF_ENC;
for (mode = 0; mode < NUM_PRED_MODES; ++mode) {
const uint8_t* const ref = it->yuv_p_ + VP8I16ModeOffsets[mode];
const score_t score = VP8SSE16x16(src, ref) * RD_DISTO_MULT
const score_t score = (score_t)VP8SSE16x16(src, ref) * RD_DISTO_MULT
+ VP8FixedCostsI16[mode] * lambda_d_i16;
if (mode > 0 && VP8FixedCostsI16[mode] > bit_limit) {
continue;

6
src/utils/rescaler_utils.c
View File

@ -85,11 +85,13 @@ int WebPRescalerGetScaledDimensions(int src_width, int src_height,
// if width is unspecified, scale original proportionally to height ratio.
if (width == 0) {
width = (src_width * height + src_height / 2) / src_height;
width =
(int)(((uint64_t)src_width * height + src_height / 2) / src_height);
}
// if height is unspecified, scale original proportionally to width ratio.
if (height == 0) {
height = (src_height * width + src_width / 2) / src_width;
height =
(int)(((uint64_t)src_height * width + src_width / 2) / src_width);
}
// Check if the overall dimensions still make sense.
if (width <= 0 || height <= 0) {