dany/libwebp
1
0
Fork 0
mirror of https://github.com/webmproject/libwebp.git synced 2024-12-27 22:28:22 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

vp8l_dec::ProcessRows: fix int overflow in multiply

Browse Source 
use 64-bit math in calculating the offsets as they may exceed 32-bits
when scaling

Bug: chromium:1196850
Change-Id: I6a484fc4dded6f6c4b82346ef145eb69c1477b3c
This commit is contained in:
James Zern 2021-06-16 10:50:20 -07:00
parent de3b4ba813
commit f6d2924757
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/dec/vp8l_dec.c
View File

@ -797,7 +797,8 @@ static void ProcessRows(VP8LDecoder* const dec, int row) {
const WebPDecBuffer* const output = dec->output_; const WebPDecBuffer* const output = dec->output_;
if (WebPIsRGBMode(output->colorspace)) { // convert to RGBA if (WebPIsRGBMode(output->colorspace)) { // convert to RGBA
const WebPRGBABuffer* const buf = &output->u.RGBA; const WebPRGBABuffer* const buf = &output->u.RGBA;
uint8_t* const rgba = buf->rgba + dec->last_out_row_ * buf->stride; uint8_t* const rgba =
buf->rgba + (int64_t)dec->last_out_row_ * buf->stride;
const int num_rows_out = const int num_rows_out =
#if !defined(WEBP_REDUCE_SIZE) #if !defined(WEBP_REDUCE_SIZE)
io->use_scaling ? io->use_scaling ?