summaryrefslogtreecommitdiff
authorSøren Sandmann <ssp@redhat.com>2014-04-09 18:14:12 (GMT)
committer Søren Sandmann <ssp@redhat.com>2014-04-15 18:21:14 (GMT)
commit857e40f3d2bc2cfb714913e0cd7e6184cf69aca3 (patch) (side-by-side diff)
tree89c5521b8d10e71ed4e6f60163a7d7db10b865c1
parent4b76bbfda670f9ede67d0449f3640605e1fc4df0 (diff)
downloadpixman-master.zip
pixman-master.tar.gz
create_bits(): Cast the result of height * stride to size_tHEADmaster
In create_bits() both height and stride are ints, so the result is also an int, which will overflow if height or stride are big enough and size_t is bigger than int. This patch simply casts height to size_t to prevent these overflows, which prevents the crash in: https://bugzilla.redhat.com/show_bug.cgi?id=972647 It's not even close to fixing the full problem of supporting big images in pixman. See also https://bugs.freedesktop.org/show_bug.cgi?id=69014
Diffstat (more/less context) (ignore whitespace changes)
-rw-r--r--pixman/pixman-bits-image.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/pixman/pixman-bits-image.c b/pixman/pixman-bits-image.c
index f9121a3..dcdcc69 100644
--- a/pixman/pixman-bits-image.c
+++ b/pixman/pixman-bits-image.c
@@ -926,7 +926,7 @@ create_bits (pixman_format_code_t format,
if (_pixman_multiply_overflows_size (height, stride))
return NULL;
- buf_size = height * stride;
+ buf_size = (size_t)height * stride;
if (rowstride_bytes)
*rowstride_bytes = stride;