diff --git a/src/dec/buffer_dec.c b/src/dec/buffer_dec.c index 6604355f..1b8e45e5 100644 --- a/src/dec/buffer_dec.c +++ b/src/dec/buffer_dec.c @@ -98,9 +98,14 @@ static VP8StatusCode AllocateBuffer(WebPDecBuffer* const buffer) { uint64_t uv_size = 0, a_size = 0, total_size; // We need memory and it hasn't been allocated yet. // => initialize output buffer, now that dimensions are known. - const int stride = w * kModeBpp[mode]; - const uint64_t size = (uint64_t)stride * h; + int stride; + uint64_t size; + if ((uint64_t)w * kModeBpp[mode] >= (1ull << 32)) { + return VP8_STATUS_INVALID_PARAM; + } + stride = w * kModeBpp[mode]; + size = (uint64_t)stride * h; if (!WebPIsRGBMode(mode)) { uv_stride = (w + 1) / 2; uv_size = (uint64_t)uv_stride * ((h + 1) / 2); diff --git a/src/enc/picture_enc.c b/src/enc/picture_enc.c index dfa66510..9f93fad6 100644 --- a/src/enc/picture_enc.c +++ b/src/enc/picture_enc.c @@ -92,8 +92,8 @@ int WebPPictureAllocYUVA(WebPPicture* const picture, int width, int height) { (WebPEncCSP)((int)picture->colorspace & WEBP_CSP_UV_MASK); const int has_alpha = (int)picture->colorspace & WEBP_CSP_ALPHA_BIT; const int y_stride = width; - const int uv_width = (width + 1) >> 1; - const int uv_height = (height + 1) >> 1; + const int uv_width = (int)(((int64_t)width + 1) >> 1); + const int uv_height = (int)(((int64_t)height + 1) >> 1); const int uv_stride = uv_width; int a_width, a_stride; uint64_t y_size, uv_size, a_size, total_size; @@ -118,8 +118,8 @@ int WebPPictureAllocYUVA(WebPPicture* const picture, int width, int height) { total_size = y_size + a_size + 2 * uv_size; // Security and validation checks - if (width <= 0 || height <= 0 || // luma/alpha param error - uv_width < 0 || uv_height < 0) { // u/v param error + if (width <= 0 || height <= 0 || // luma/alpha param error + uv_width <= 0 || uv_height <= 0) { // u/v param error return WebPEncodingSetError(picture, VP8_ENC_ERROR_BAD_DIMENSION); } // allocate a new buffer. diff --git a/src/enc/quant_enc.c b/src/enc/quant_enc.c index b118fb2a..4bf2ba1e 100644 --- a/src/enc/quant_enc.c +++ b/src/enc/quant_enc.c @@ -1162,7 +1162,7 @@ static void RefineUsingDistortion(VP8EncIterator* const it, const uint8_t* const src = it->yuv_in_ + Y_OFF_ENC; for (mode = 0; mode < NUM_PRED_MODES; ++mode) { const uint8_t* const ref = it->yuv_p_ + VP8I16ModeOffsets[mode]; - const score_t score = VP8SSE16x16(src, ref) * RD_DISTO_MULT + const score_t score = (score_t)VP8SSE16x16(src, ref) * RD_DISTO_MULT + VP8FixedCostsI16[mode] * lambda_d_i16; if (mode > 0 && VP8FixedCostsI16[mode] > bit_limit) { continue; diff --git a/src/utils/rescaler_utils.c b/src/utils/rescaler_utils.c index 0d1f80da..f1d079da 100644 --- a/src/utils/rescaler_utils.c +++ b/src/utils/rescaler_utils.c @@ -85,11 +85,13 @@ int WebPRescalerGetScaledDimensions(int src_width, int src_height, // if width is unspecified, scale original proportionally to height ratio. if (width == 0) { - width = (src_width * height + src_height / 2) / src_height; + width = + (int)(((uint64_t)src_width * height + src_height / 2) / src_height); } // if height is unspecified, scale original proportionally to width ratio. if (height == 0) { - height = (src_height * width + src_width / 2) / src_width; + height = + (int)(((uint64_t)src_height * width + src_width / 2) / src_width); } // Check if the overall dimensions still make sense. if (width <= 0 || height <= 0) {