Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-07 09:54:42 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1784835. Use checkedint in webp encoder to avoid overflow. r=aosmond

Browse Source 
Differential Revision: https://phabricator.services.mozilla.com/D154622
This commit is contained in:
Timothy Nikkel 2022-08-23 08:42:49 +00:00
parent 6a505585d0
commit ad4d2d61f1
1 changed files with 24 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
image/encoders/webp/nsWebPEncoder.cpp
View File

@ -103,16 +103,26 @@ nsWebPEncoder::InitFromData(const uint8_t* aData,
size_t size = 0;
CheckedInt32 width = CheckedInt32(aWidth);
CheckedInt32 height = CheckedInt32(aHeight);
CheckedInt32 stride = CheckedInt32(aStride);
if (!width.isValid() || !height.isValid() || !stride.isValid() ||
!(CheckedUint32(aStride) * CheckedUint32(aHeight)).isValid()) {
return NS_ERROR_INVALID_ARG;
}
if (aInputFormat == INPUT_FORMAT_RGB) {
size = quality == 100 ? WebPEncodeLosslessRGB(aData, aWidth, aHeight,
aStride, &mImageBuffer)
: WebPEncodeRGB(aData, aWidth, aHeight, aStride,
quality, &mImageBuffer);
size = quality == 100
? WebPEncodeLosslessRGB(aData, width.value(), height.value(),
stride.value(), &mImageBuffer)
: WebPEncodeRGB(aData, width.value(), height.value(),
stride.value(), quality, &mImageBuffer);
} else if (aInputFormat == INPUT_FORMAT_RGBA) {
size = quality == 100 ? WebPEncodeLosslessRGBA(aData, aWidth, aHeight,
aStride, &mImageBuffer)
: WebPEncodeRGBA(aData, aWidth, aHeight, aStride,
quality, &mImageBuffer);
size = quality == 100
? WebPEncodeLosslessRGBA(aData, width.value(), height.value(),
stride.value(), &mImageBuffer)
: WebPEncodeRGBA(aData, width.value(), height.value(),
stride.value(), quality, &mImageBuffer);
} else if (aInputFormat == INPUT_FORMAT_HOSTARGB) {
UniquePtr<uint8_t[]> aDest = MakeUnique<uint8_t[]>(aStride * aHeight);
@ -139,10 +149,12 @@ nsWebPEncoder::InitFromData(const uint8_t* aData,
}
}
size = quality == 100 ? WebPEncodeLosslessRGBA(aDest.get(), aWidth, aHeight,
aStride, &mImageBuffer)
: WebPEncodeRGBA(aDest.get(), aWidth, aHeight,
aStride, quality, &mImageBuffer);
size =
quality == 100
? WebPEncodeLosslessRGBA(aDest.get(), width.value(), height.value(),
stride.value(), &mImageBuffer)
: WebPEncodeRGBA(aDest.get(), width.value(), height.value(),
stride.value(), quality, &mImageBuffer);
}
mFinished = true;