diff options
| author | James Zern <jzern@google.com> | 2021-06-16 10:50:20 -0700 |
|---|---|---|
| committer | James Zern <jzern@google.com> | 2021-06-16 10:50:44 -0700 |
| commit | f6d2924757f356fcdc620ddaf4c200728a78df09 (patch) | |
| tree | a1567cbd99518a200021a1220dc66e8d203bb01d | |
| parent | de3b4ba813c92935aae9709e8b191e6d653137ea (diff) | |
| download | libwebp-f6d2924757f356fcdc620ddaf4c200728a78df09.tar.gz | |
vp8l_dec::ProcessRows: fix int overflow in multiply
use 64-bit math in calculating the offsets as they may exceed 32-bits
when scaling
Bug: chromium:1196850
Change-Id: I6a484fc4dded6f6c4b82346ef145eb69c1477b3c
| -rw-r--r-- | src/dec/vp8l_dec.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/dec/vp8l_dec.c b/src/dec/vp8l_dec.c index 60edc43b..13d106ff 100644 --- a/src/dec/vp8l_dec.c +++ b/src/dec/vp8l_dec.c @@ -797,7 +797,8 @@ static void ProcessRows(VP8LDecoder* const dec, int row) { const WebPDecBuffer* const output = dec->output_; if (WebPIsRGBMode(output->colorspace)) { // convert to RGBA const WebPRGBABuffer* const buf = &output->u.RGBA; - uint8_t* const rgba = buf->rgba + dec->last_out_row_ * buf->stride; + uint8_t* const rgba = + buf->rgba + (int64_t)dec->last_out_row_ * buf->stride; const int num_rows_out = #if !defined(WEBP_REDUCE_SIZE) io->use_scaling ? |