From 6a9916d73480e820ea46316ec8b5bd4c7d04d1f5 Mon Sep 17 00:00:00 2001 From: James Zern Date: Tue, 20 Apr 2021 14:26:06 -0700 Subject: [PATCH] WebPRescalerInit: add missing int64_t promotion large values of x_add and y_add may rollover an int causing a later assertion to fail in WebPRescalerExportRow due to fxy_scale incorrectly being set to 0. fixes: src/dsp/rescaler.c:178: void WebPRescalerExportRow(WebPRescaler *const): Assertion `wrk->src_height == wrk->dst_height && wrk->x_add == 1' failed. Bug: chromium:1196480 Change-Id: I2c00f015d61a1257033d8edb1edd4d060d6878b7 --- src/utils/rescaler_utils.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/utils/rescaler_utils.c b/src/utils/rescaler_utils.c index 89b82c1b..a4e80953 100644 --- a/src/utils/rescaler_utils.c +++ b/src/utils/rescaler_utils.c @@ -51,8 +51,9 @@ void WebPRescalerInit(WebPRescaler* const wrk, int src_width, int src_height, // This is WEBP_RESCALER_FRAC(dst_height, x_add * y_add) without the cast. // Its value is <= WEBP_RESCALER_ONE, because dst_height <= wrk->y_add, and // wrk->x_add >= 1; - const uint64_t ratio = - (uint64_t)dst_height * WEBP_RESCALER_ONE / (wrk->x_add * wrk->y_add); + const uint64_t num = (uint64_t)dst_height * WEBP_RESCALER_ONE; + const uint64_t den = (uint64_t)wrk->x_add * wrk->y_add; + const uint64_t ratio = num / den; if (ratio != (uint32_t)ratio) { // When ratio == WEBP_RESCALER_ONE, we can't represent the ratio with the // current fixed-point precision. This happens when src_height ==