diff options
| -rw-r--r-- | native/graphics/jni/imagedecoder.cpp | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/native/graphics/jni/imagedecoder.cpp b/native/graphics/jni/imagedecoder.cpp index c1143ce9c3dc..86452357c3c3 100644 --- a/native/graphics/jni/imagedecoder.cpp +++ b/native/graphics/jni/imagedecoder.cpp @@ -28,6 +28,7 @@ #include <utils/Color.h> #include <fcntl.h> +#include <limits> #include <optional> #include <sys/stat.h> #include <sys/types.h> @@ -70,6 +71,14 @@ static int createFromStream(std::unique_ptr<SkStreamRewindable> stream, AImageDe return ResultToErrorCode(result); } + // AImageDecoderHeaderInfo_getWidth/Height return an int32_t. Ensure that + // the conversion is safe. + const auto& info = androidCodec->getInfo(); + if (info.width() > std::numeric_limits<int32_t>::max() + || info.height() > std::numeric_limits<int32_t>::max()) { + return ANDROID_IMAGE_DECODER_INVALID_INPUT; + } + *outDecoder = reinterpret_cast<AImageDecoder*>(new ImageDecoder(std::move(androidCodec))); return ANDROID_IMAGE_DECODER_SUCCESS; } |