mirror of
https://github.com/webmproject/libwebp.git
synced 2025-08-29 15:22:12 +02:00
check limit of width * height is 32 bits
Update the RIFF-specs file too Change-Id: I113a7e25da2f7a19c1344c1dc5d496127cfe2596
This commit is contained in:
@@ -444,6 +444,9 @@ static ParseStatus ParseVP8X(WebPDemuxer* const dmux) {
|
||||
Skip(mem, 3); // Reserved.
|
||||
dmux->canvas_width_ = 1 + GetLE24s(mem);
|
||||
dmux->canvas_height_ = 1 + GetLE24s(mem);
|
||||
if (dmux->canvas_width_ * (uint64_t)dmux->canvas_height_ >= MAX_IMAGE_AREA) {
|
||||
return PARSE_ERROR; // image final dimension is too large
|
||||
}
|
||||
Skip(mem, vp8x_size - VP8X_CHUNK_SIZE); // skip any trailing data.
|
||||
dmux->state_ = WEBP_DEMUX_PARSED_HEADER;
|
||||
|
||||
|
@@ -218,6 +218,7 @@ static uint8_t* EmitVP8XChunk(uint8_t* const dst, uint32_t width,
|
||||
const size_t vp8x_size = CHUNK_HEADER_SIZE + VP8X_CHUNK_SIZE;
|
||||
assert(width >= 1 && height >= 1);
|
||||
assert(width <= MAX_CANVAS_SIZE && height <= MAX_CANVAS_SIZE);
|
||||
assert(width * (uint64_t)height < MAX_IMAGE_AREA);
|
||||
PutLE32(dst, mktag('V', 'P', '8', 'X'));
|
||||
PutLE32(dst + TAG_SIZE, VP8X_CHUNK_SIZE);
|
||||
PutLE32(dst + CHUNK_HEADER_SIZE, flags);
|
||||
|
Reference in New Issue
Block a user