dany/libwebp
1
0
Fork 0
mirror of https://github.com/webmproject/libwebp.git synced 2024-12-27 06:08:21 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix signed integer overflows.

Browse Source 
Change-Id: I62c9949f0edac58d69d991d6be5f85ae9e4d62a9
This commit is contained in:
Vincent Rabaud 2017-08-31 11:56:28 +02:00
parent f66f94ef36
commit 3993af127e
4 changed files with 16 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/dec/buffer_dec.c
View File

@ -98,9 +98,14 @@ static VP8StatusCode AllocateBuffer(WebPDecBuffer* const buffer) {
uint64_t uv_size = 0, a_size = 0, total_size; uint64_t uv_size = 0, a_size = 0, total_size;
// We need memory and it hasn't been allocated yet. // We need memory and it hasn't been allocated yet.
// => initialize output buffer, now that dimensions are known. // => initialize output buffer, now that dimensions are known.
const int stride = w * kModeBpp[mode]; int stride;
const uint64_t size = (uint64_t)stride * h; uint64_t size;
if ((uint64_t)w * kModeBpp[mode] >= (1ull << 32)) {
return VP8_STATUS_INVALID_PARAM;
}
stride = w * kModeBpp[mode];
size = (uint64_t)stride * h;
if (!WebPIsRGBMode(mode)) { if (!WebPIsRGBMode(mode)) {
uv_stride = (w + 1) / 2; uv_stride = (w + 1) / 2;
uv_size = (uint64_t)uv_stride * ((h + 1) / 2); uv_size = (uint64_t)uv_stride * ((h + 1) / 2);

8
src/enc/picture_enc.c
View File

@ -92,8 +92,8 @@ int WebPPictureAllocYUVA(WebPPicture* const picture, int width, int height) {
(WebPEncCSP)((int)picture->colorspace & WEBP_CSP_UV_MASK); (WebPEncCSP)((int)picture->colorspace & WEBP_CSP_UV_MASK);
const int has_alpha = (int)picture->colorspace & WEBP_CSP_ALPHA_BIT; const int has_alpha = (int)picture->colorspace & WEBP_CSP_ALPHA_BIT;
const int y_stride = width; const int y_stride = width;
const int uv_width = (width + 1) >> 1; const int uv_width = (int)(((int64_t)width + 1) >> 1);
const int uv_height = (height + 1) >> 1; const int uv_height = (int)(((int64_t)height + 1) >> 1);
const int uv_stride = uv_width; const int uv_stride = uv_width;
int a_width, a_stride; int a_width, a_stride;
uint64_t y_size, uv_size, a_size, total_size; uint64_t y_size, uv_size, a_size, total_size;
@ -118,8 +118,8 @@ int WebPPictureAllocYUVA(WebPPicture* const picture, int width, int height) {
total_size = y_size + a_size + 2 * uv_size; total_size = y_size + a_size + 2 * uv_size;
// Security and validation checks // Security and validation checks
if (width <= 0 || height <= 0 || // luma/alpha param error if (width <= 0 || height <= 0 || // luma/alpha param error
uv_width < 0 || uv_height < 0) { // u/v param error uv_width <= 0 || uv_height <= 0) { // u/v param error
return WebPEncodingSetError(picture, VP8_ENC_ERROR_BAD_DIMENSION); return WebPEncodingSetError(picture, VP8_ENC_ERROR_BAD_DIMENSION);
} }
// allocate a new buffer. // allocate a new buffer.

2
src/enc/quant_enc.c
View File

@ -1162,7 +1162,7 @@ static void RefineUsingDistortion(VP8EncIterator* const it,
const uint8_t* const src = it->yuv_in_ + Y_OFF_ENC; const uint8_t* const src = it->yuv_in_ + Y_OFF_ENC;
for (mode = 0; mode < NUM_PRED_MODES; ++mode) { for (mode = 0; mode < NUM_PRED_MODES; ++mode) {
const uint8_t* const ref = it->yuv_p_ + VP8I16ModeOffsets[mode]; const uint8_t* const ref = it->yuv_p_ + VP8I16ModeOffsets[mode];
const score_t score = VP8SSE16x16(src, ref) * RD_DISTO_MULT const score_t score = (score_t)VP8SSE16x16(src, ref) * RD_DISTO_MULT
+ VP8FixedCostsI16[mode] * lambda_d_i16; + VP8FixedCostsI16[mode] * lambda_d_i16;
if (mode > 0 && VP8FixedCostsI16[mode] > bit_limit) { if (mode > 0 && VP8FixedCostsI16[mode] > bit_limit) {
continue; continue;

6
src/utils/rescaler_utils.c
View File

@ -85,11 +85,13 @@ int WebPRescalerGetScaledDimensions(int src_width, int src_height,
// if width is unspecified, scale original proportionally to height ratio. // if width is unspecified, scale original proportionally to height ratio.
if (width == 0) { if (width == 0) {
width = (src_width * height + src_height / 2) / src_height; width =
(int)(((uint64_t)src_width * height + src_height / 2) / src_height);
} }
// if height is unspecified, scale original proportionally to width ratio. // if height is unspecified, scale original proportionally to width ratio.
if (height == 0) { if (height == 0) {
height = (src_height * width + src_width / 2) / src_width; height =
(int)(((uint64_t)src_height * width + src_width / 2) / src_width);
} }
// Check if the overall dimensions still make sense. // Check if the overall dimensions still make sense.
if (width <= 0 || height <= 0) { if (width <= 0 || height <= 0) {