diff options
author | Tarja Sundqvist <tarja.sundqvist@qt.io> | 2022-09-12 18:29:49 +0300 |
---|---|---|
committer | Tarja Sundqvist <tarja.sundqvist@qt.io> | 2022-09-12 18:29:49 +0300 |
commit | 7824fe51318b8a87caa9ef3ed4db99914e22e6e4 (patch) | |
tree | 7b861acefc1acb41a8bc806dfa7693aa41f53263 /src/3rdparty/libwebp/src/demux/anim_decode.c | |
parent | 3c316057a0e6dae324f92a3bef2c31c398c2ea51 (diff) | |
parent | 6c0e0f2a82d8d26e33eb7190066c9872a00a0f8b (diff) |
Merge remote-tracking branch 'origin/tqtc/lts-5.15.7' into tqtc/lts-5.15-opensourcev5.15.7-lts-lgpl
Change-Id: I8f97dd74f81ed23ca3cb6634068e2c77e7ea9275
Diffstat (limited to 'src/3rdparty/libwebp/src/demux/anim_decode.c')
-rw-r--r-- | src/3rdparty/libwebp/src/demux/anim_decode.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/src/3rdparty/libwebp/src/demux/anim_decode.c b/src/3rdparty/libwebp/src/demux/anim_decode.c index 3dcacc3..2bf4dcf 100644 --- a/src/3rdparty/libwebp/src/demux/anim_decode.c +++ b/src/3rdparty/libwebp/src/demux/anim_decode.c @@ -87,11 +87,19 @@ WebPAnimDecoder* WebPAnimDecoderNewInternal( int abi_version) { WebPAnimDecoderOptions options; WebPAnimDecoder* dec = NULL; + WebPBitstreamFeatures features; if (webp_data == NULL || WEBP_ABI_IS_INCOMPATIBLE(abi_version, WEBP_DEMUX_ABI_VERSION)) { return NULL; } + // Validate the bitstream before doing expensive allocations. The demuxer may + // be more tolerant than the decoder. + if (WebPGetFeatures(webp_data->bytes, webp_data->size, &features) != + VP8_STATUS_OK) { + return NULL; + } + // Note: calloc() so that the pointer members are initialized to NULL. dec = (WebPAnimDecoder*)WebPSafeCalloc(1ULL, sizeof(*dec)); if (dec == NULL) goto Error; @@ -145,7 +153,7 @@ static int ZeroFillCanvas(uint8_t* buf, uint32_t canvas_width, uint32_t canvas_height) { const uint64_t size = (uint64_t)canvas_width * canvas_height * NUM_CHANNELS * sizeof(*buf); - if (size != (size_t)size) return 0; + if (!CheckSizeOverflow(size)) return 0; memset(buf, 0, (size_t)size); return 1; } @@ -166,7 +174,7 @@ static void ZeroFillFrameRect(uint8_t* buf, int buf_stride, int x_offset, static int CopyCanvas(const uint8_t* src, uint8_t* dst, uint32_t width, uint32_t height) { const uint64_t size = (uint64_t)width * height * NUM_CHANNELS; - if (size != (size_t)size) return 0; + if (!CheckSizeOverflow(size)) return 0; assert(src != NULL && dst != NULL); memcpy(dst, src, (size_t)size); return 1; |