dany/libwebp
1
0
Fork 0
mirror of https://github.com/webmproject/libwebp.git synced 2024-12-29 06:58:21 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

loosen the padding check on buffer size

Browse Source 
Strictly speaking, the last (or first) row doesn't require padding.

cf https://code.google.com/p/webp/issues/detail?id=258

(cherry picked from commit 15ca5014f1)

Change-Id: Ie9ec8eb776fec1f5cea4cf9e21e81901fd79bf33
This commit is contained in:
Pascal Massimino 2015-09-08 23:54:32 -07:00 committed by James Zern
parent 53d22c5b3e
commit d089362d07
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/dec/buffer.c
View File

@ -67,7 +67,9 @@ static VP8StatusCode CheckDecBuffer(const WebPDecBuffer* const buffer) {
} else { // RGB checks } else { // RGB checks
const WebPRGBABuffer* const buf = &buffer->u.RGBA; const WebPRGBABuffer* const buf = &buffer->u.RGBA;
const int stride = abs(buf->stride); const int stride = abs(buf->stride);
const uint64_t size = (uint64_t)stride * height; // strictly speaking, the very last (or first, if flipped) row
// doesn't require padding.
const uint64_t size = (uint64_t)stride * (height - 1) + width;
ok &= (size <= buf->size); ok &= (size <= buf->size);
ok &= (stride >= width * kModeBpp[mode]); ok &= (stride >= width * kModeBpp[mode]);
ok &= (buf->rgba != NULL); ok &= (buf->rgba != NULL);