Fix overflow when comparing two ints by promoting the sum to 64-bits.
R=reed@google.com, scroggo@google.com Author: djsollen@google.com Review URL: https://codereview.chromium.org/505153003
This commit is contained in:
parent
0b14aa80dd
commit
97b49478cf
@ -154,7 +154,8 @@ bool SkICOImageDecoder::onDecode(SkStream* stream, SkBitmap* bm, Mode mode)
|
||||
//int fakeBitCount = read2Bytes(buf, 12 + choice*16); //should be real - usually 0
|
||||
const size_t size = read4Bytes(buf, 14 + choice*16); //matters?
|
||||
const size_t offset = read4Bytes(buf, 18 + choice*16);
|
||||
if ((offset + size) > length) {
|
||||
// promote the sum to 64-bits to avoid overflow
|
||||
if (((uint64_t)offset + size) > length) {
|
||||
return false;
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user