diff options
| author | Søren Sandmann <ssp@redhat.com> | 2014-04-09 14:14:12 -0400 |
|---|---|---|
| committer | Søren Sandmann <ssp@redhat.com> | 2014-04-15 14:21:14 -0400 |
| commit | 857e40f3d2bc2cfb714913e0cd7e6184cf69aca3 (patch) | |
| tree | 89c5521b8d10e71ed4e6f60163a7d7db10b865c1 | |
| parent | 4b76bbfda670f9ede67d0449f3640605e1fc4df0 (diff) | |
create_bits(): Cast the result of height * stride to size_t
In create_bits() both height and stride are ints, so the result is
also an int, which will overflow if height or stride are big enough
and size_t is bigger than int.
This patch simply casts height to size_t to prevent these overflows,
which prevents the crash in:
https://bugzilla.redhat.com/show_bug.cgi?id=972647
It's not even close to fixing the full problem of supporting big
images in pixman.
See also
https://bugs.freedesktop.org/show_bug.cgi?id=69014
| -rw-r--r-- | pixman/pixman-bits-image.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/pixman/pixman-bits-image.c b/pixman/pixman-bits-image.c index f9121a3..dcdcc69 100644 --- a/pixman/pixman-bits-image.c +++ b/pixman/pixman-bits-image.c @@ -926,7 +926,7 @@ create_bits (pixman_format_code_t format, if (_pixman_multiply_overflows_size (height, stride)) return NULL; - buf_size = height * stride; + buf_size = (size_t)height * stride; if (rowstride_bytes) *rowstride_bytes = stride; |