diff options
author | Tarja Sundqvist <tarja.sundqvist@qt.io> | 2022-09-12 18:29:49 +0300 |
---|---|---|
committer | Tarja Sundqvist <tarja.sundqvist@qt.io> | 2022-09-12 18:29:49 +0300 |
commit | 7824fe51318b8a87caa9ef3ed4db99914e22e6e4 (patch) | |
tree | 7b861acefc1acb41a8bc806dfa7693aa41f53263 /src/3rdparty/libwebp/src/dec/buffer_dec.c | |
parent | 3c316057a0e6dae324f92a3bef2c31c398c2ea51 (diff) | |
parent | 6c0e0f2a82d8d26e33eb7190066c9872a00a0f8b (diff) |
Merge remote-tracking branch 'origin/tqtc/lts-5.15.7' into tqtc/lts-5.15-opensourcev5.15.7-lts-lgpl
Change-Id: I8f97dd74f81ed23ca3cb6634068e2c77e7ea9275
Diffstat (limited to 'src/3rdparty/libwebp/src/dec/buffer_dec.c')
-rw-r--r-- | src/3rdparty/libwebp/src/dec/buffer_dec.c | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/src/3rdparty/libwebp/src/dec/buffer_dec.c b/src/3rdparty/libwebp/src/dec/buffer_dec.c index 3cd94eb..4786cf0 100644 --- a/src/3rdparty/libwebp/src/dec/buffer_dec.c +++ b/src/3rdparty/libwebp/src/dec/buffer_dec.c @@ -102,7 +102,7 @@ static VP8StatusCode AllocateBuffer(WebPDecBuffer* const buffer) { int stride; uint64_t size; - if ((uint64_t)w * kModeBpp[mode] >= (1ull << 32)) { + if ((uint64_t)w * kModeBpp[mode] >= (1ull << 31)) { return VP8_STATUS_INVALID_PARAM; } stride = w * kModeBpp[mode]; @@ -117,7 +117,6 @@ static VP8StatusCode AllocateBuffer(WebPDecBuffer* const buffer) { } total_size = size + 2 * uv_size + a_size; - // Security/sanity checks output = (uint8_t*)WebPSafeMalloc(total_size, sizeof(*output)); if (output == NULL) { return VP8_STATUS_OUT_OF_MEMORY; @@ -156,11 +155,11 @@ VP8StatusCode WebPFlipBuffer(WebPDecBuffer* const buffer) { } if (WebPIsRGBMode(buffer->colorspace)) { WebPRGBABuffer* const buf = &buffer->u.RGBA; - buf->rgba += (buffer->height - 1) * buf->stride; + buf->rgba += (int64_t)(buffer->height - 1) * buf->stride; buf->stride = -buf->stride; } else { WebPYUVABuffer* const buf = &buffer->u.YUVA; - const int H = buffer->height; + const int64_t H = buffer->height; buf->y += (H - 1) * buf->y_stride; buf->y_stride = -buf->y_stride; buf->u += ((H - 1) >> 1) * buf->u_stride; @@ -188,8 +187,7 @@ VP8StatusCode WebPAllocateDecBuffer(int width, int height, const int ch = options->crop_height; const int x = options->crop_left & ~1; const int y = options->crop_top & ~1; - if (x < 0 || y < 0 || cw <= 0 || ch <= 0 || - x + cw > width || y + ch > height) { + if (!WebPCheckCropDimensions(width, height, x, y, cw, ch)) { return VP8_STATUS_INVALID_PARAM; // out of frame boundary. } width = cw; |