diff options
author | Yujie Qin <yujieqin@google.com> | 2017-05-08 10:14:37 +0200 |
---|---|---|
committer | JP Sugarbroad <jpsugar@google.com> | 2017-05-19 00:25:00 -0700 |
commit | 33e1e3ebfffd8d39efecb931480ee6146c7c1529 (patch) | |
tree | d49fb775bdf32dcb66fe70a228c476446d4fbe31 | |
parent | 0420a20d94d620f471e47cf3f8c40facca5de58e (diff) | |
download | dng_sdk-33e1e3ebfffd8d39efecb931480ee6146c7c1529.tar.gz |
Throw exception on integer overflow in dng_ifd.cpp.android-7.1.1_r61android-7.1.1_r60android-7.1.1_r59nougat-mr1.8-releasenougat-mr1-security-release
Bug: 36724453
Test: manual, see b/36724453
Change-Id: I6115361002d3e4167ff7ff654e1fd2176ac24e87
(cherry picked from commit 2cb858a7ed887b231086ae81e2b35a3614299da3)
(cherry picked from commit 5e702072c8012638e4356eb2e62f5f8f910bd01d)
-rw-r--r-- | source/dng_ifd.cpp | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/source/dng_ifd.cpp b/source/dng_ifd.cpp index 317ebf9..7f22065 100644 --- a/source/dng_ifd.cpp +++ b/source/dng_ifd.cpp @@ -3979,7 +3979,7 @@ uint32 dng_ifd::TilesAcross () const if (fTileWidth) { - return (fImageWidth + fTileWidth - 1) / fTileWidth; + return (SafeUint32Sub(SafeUint32Add(fImageWidth, fTileWidth), 1)) / fTileWidth; } @@ -3995,7 +3995,7 @@ uint32 dng_ifd::TilesDown () const if (fTileLength) { - return (fImageLength + fTileLength - 1) / fTileLength; + return (SafeUint32Sub(SafeUint32Add(fImageLength, fTileLength), 1)) / fTileLength; } |