diff options
| author | Pascal Massimino <pascal.massimino@gmail.com> | 2018-05-25 13:25:39 +0200 |
|---|---|---|
| committer | James Zern <jzern@google.com> | 2018-06-01 20:10:17 -0700 |
| commit | dad31750e374eff8e02fb467eb562d4bf236ed6e (patch) | |
| tree | c426ea7cb301986bf354077008e3a18d8dd6587e | |
| parent | 4b282e13ad0cf7f1a3b4431788bddef1d6b11762 (diff) | |
| download | libwebp-dad31750e374eff8e02fb467eb562d4bf236ed6e.tar.gz | |
fix invalid check for buffer size
BUG=webp:383
Change-Id: I8ebbb5ca4860d73c3b59b12e238b54a89184bed0
(cherry picked from commit 71ed73cf86132394ea25ae9c7ed431e0d71043f5)
| -rw-r--r-- | src/dec/buffer_dec.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/dec/buffer_dec.c b/src/dec/buffer_dec.c index 75eb3c40..3cd94eb4 100644 --- a/src/dec/buffer_dec.c +++ b/src/dec/buffer_dec.c @@ -74,7 +74,8 @@ static VP8StatusCode CheckDecBuffer(const WebPDecBuffer* const buffer) { } else { // RGB checks const WebPRGBABuffer* const buf = &buffer->u.RGBA; const int stride = abs(buf->stride); - const uint64_t size = MIN_BUFFER_SIZE(width, height, stride); + const uint64_t size = + MIN_BUFFER_SIZE(width * kModeBpp[mode], height, stride); ok &= (size <= buf->size); ok &= (stride >= width * kModeBpp[mode]); ok &= (buf->rgba != NULL); |