blob: b0c1419e022bb12e791d2a285b905b594c4e47a4 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
|
--- libgd/gd_webp.c.orig 2016-09-28 10:07:06.092196000 +0200
+++ libgd/gd_webp.c 2016-09-28 10:08:12.429030000 +0200
@@ -180,6 +180,15 @@ void gdImageWebpCtx (gdImagePtr im, gdIO
/* Conversion to Y,U,V buffer */
yuv_width = (width + 1) >> 1;
yuv_height = (height + 1) >> 1;
+
+ if (overflow2(width, height)) {
+ return;
+ }
+ /* simplification possible, because WebP must not be larger than 16384**2 */
+ if (overflow2(width * height, 2 * sizeof(unsigned char))) {
+ return;
+ }
+
yuv_nbytes = width * height + 2 * yuv_width * yuv_height;
if ((Y = (unsigned char *)gdCalloc(yuv_nbytes, sizeof(unsigned char))) == NULL) {
|
