dany/libwebp
1
0
Fork 0
mirror of https://github.com/webmproject/libwebp.git synced 2024-11-20 12:28:26 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

WebPRescalerImportRowExpand_C: promote some vals before multiply

Browse Source 
avoids integer overflow in extreme cases:
src/dsp/rescaler.c:45:32: runtime error: signed integer overflow: 129 *
16777215 cannot be represented in type 'int'
    #0 0x556bde3538e3 in WebPRescalerImportRowExpand_C src/dsp/rescaler.c:45:32
    #1 0x556bde357465 in RescalerImportRowExpand_SSE2 src/dsp/rescaler_sse2.c:56:5
    ...

Bug: chromium:1196850
Change-Id: I4f923807f106713e113f3eec62a1d1c346066345
This commit is contained in:
James Zern 2021-06-07 18:59:33 -07:00
parent 776983d427
commit a2fce86744
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/dsp/rescaler.c
View File

@ -38,8 +38,9 @@ void WebPRescalerImportRowExpand_C(WebPRescaler* const wrk,
int x_out = channel; int x_out = channel;
// simple bilinear interpolation // simple bilinear interpolation
int accum = wrk->x_add; int accum = wrk->x_add;
int left = src[x_in]; rescaler_t left = (rescaler_t)src[x_in];
int right = (wrk->src_width > 1) ? src[x_in + x_stride] : left; rescaler_t right =
(wrk->src_width > 1) ? (rescaler_t)src[x_in + x_stride] : left;
x_in += x_stride; x_in += x_stride;
while (1) { while (1) {
wrk->frow[x_out] = right * wrk->x_add + (left - right) * accum; wrk->frow[x_out] = right * wrk->x_add + (left - right) * accum;
@ -50,7 +51,7 @@ void WebPRescalerImportRowExpand_C(WebPRescaler* const wrk,
left = right; left = right;
x_in += x_stride; x_in += x_stride;
assert(x_in < wrk->src_width * x_stride); assert(x_in < wrk->src_width * x_stride);
right = src[x_in]; right = (rescaler_t)src[x_in];
accum += wrk->x_add; accum += wrk->x_add;
} }
} }