From f6d2924757f356fcdc620ddaf4c200728a78df09 Mon Sep 17 00:00:00 2001
From: James Zern <jzern@google.com>
Date: Wed, 16 Jun 2021 10:50:20 -0700
Subject: [PATCH] vp8l_dec::ProcessRows: fix int overflow in multiply

use 64-bit math in calculating the offsets as they may exceed 32-bits
when scaling

Bug: chromium:1196850
Change-Id: I6a484fc4dded6f6c4b82346ef145eb69c1477b3c
---
 src/dec/vp8l_dec.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/dec/vp8l_dec.c b/src/dec/vp8l_dec.c
index 60edc43b..13d106ff 100644
--- a/src/dec/vp8l_dec.c
+++ b/src/dec/vp8l_dec.c
@@ -797,7 +797,8 @@ static void ProcessRows(VP8LDecoder* const dec, int row) {
       const WebPDecBuffer* const output = dec->output_;
       if (WebPIsRGBMode(output->colorspace)) {  // convert to RGBA
         const WebPRGBABuffer* const buf = &output->u.RGBA;
-        uint8_t* const rgba = buf->rgba + dec->last_out_row_ * buf->stride;
+        uint8_t* const rgba =
+            buf->rgba + (int64_t)dec->last_out_row_ * buf->stride;
         const int num_rows_out =
 #if !defined(WEBP_REDUCE_SIZE)
          io->use_scaling ?