Fix overflow when comparing two ints by promoting the sum to 64-bits.

R=reed@google.com, scroggo@google.com

Author: djsollen@google.com

Review URL: https://codereview.chromium.org/505153003
This commit is contained in:
djsollen 2014-08-26 08:31:24 -07:00 committed by Commit bot
parent 0b14aa80dd
commit 97b49478cf

View File

@ -154,7 +154,8 @@ bool SkICOImageDecoder::onDecode(SkStream* stream, SkBitmap* bm, Mode mode)
//int fakeBitCount = read2Bytes(buf, 12 + choice*16); //should be real - usually 0
const size_t size = read4Bytes(buf, 14 + choice*16); //matters?
const size_t offset = read4Bytes(buf, 18 + choice*16);
if ((offset + size) > length) {
// promote the sum to 64-bits to avoid overflow
if (((uint64_t)offset + size) > length) {
return false;
}