wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-10-24 16:17:29 +09:00
Code Issues Projects Releases Packages Wiki Activity

[image] Add a sanity check to JPEG encoder buffer handling, just in case.

Browse source
This commit is contained in:
Moonchild 2020-07-09 11:22:40 +00:00 • committed by Roy Tam
commit 6cf5f024c4
1 changed files with 8 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

11
image/encoders/jpeg/nsJPEGEncoder.cpp
View file

@ -8,6 +8,7 @@
#include "nsString.h" #include "nsString.h"
#include "nsStreamUtils.h" #include "nsStreamUtils.h"
#include "gfxColor.h" #include "gfxColor.h"
#include "mozilla/CheckedInt.h"
#include <setjmp.h> #include <setjmp.h>
#include "jerror.h" #include "jerror.h"
@ -430,10 +431,14 @@ nsJPEGEncoder::emptyOutputBuffer(jpeg_compress_struct* cinfo)
that->mImageBufferUsed = that->mImageBufferSize; that->mImageBufferUsed = that->mImageBufferSize;
// expand buffer, just double size each time // expand buffer, just double size each time
that->mImageBufferSize *= 2; uint8_t* newBuf = nullptr;
CheckedInt<uint32_t> bufSize =
CheckedInt<uint32_t>(that->mImageBufferSize) * 2;
if (bufSize.isValid()) {
that->mImageBufferSize = bufSize.value();
newBuf = (uint8_t*)realloc(that->mImageBuffer, that->mImageBufferSize);
}
uint8_t* newBuf = (uint8_t*)realloc(that->mImageBuffer,
that->mImageBufferSize);
if (!newBuf) { if (!newBuf) {
// can't resize, just zero (this will keep us from writing more) // can't resize, just zero (this will keep us from writing more)
free(that->mImageBuffer); free(that->mImageBuffer);