dany/libwebp
1
0
Fork 0
mirror of https://github.com/webmproject/libwebp.git synced 2025-02-13 07:22:52 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge "Fix a crash due to wrong pointer-integer arithmetic."

Browse Source
This commit is contained in:
pascal massimino 2012-05-09 02:22:01 -07:00 committed by Gerrit Code Review
commit 89d803c423
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/dec/vp8l.c
View File

@ -596,10 +596,12 @@ static int DecodeImageData(VP8LDecoder* const dec,
const int length_sym = code - NUM_LITERAL_CODES;
const int length = GetCopyLength(length_sym, br);
const int dist_symbol = ReadSymbol(&htree_group->htrees_[DIST], br);
// TODO(urvang): Evaluate if we should check 'dist_symbol', 'dist_code'
// and/or 'dist' to be valid.
VP8LFillBitWindow(br);
dist_code = GetCopyDistance(dist_symbol, br);
dist = PlaneCodeToDistance(width, dist_code);
if (src - dist < data || src + length > src_end) {
if (src - data < dist || src_end - src < length) {
ok = 0;
goto Error;
}