diff options
Diffstat (limited to 'native')
| -rw-r--r-- | native/graphics/jni/imagedecoder.cpp | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/native/graphics/jni/imagedecoder.cpp b/native/graphics/jni/imagedecoder.cpp index 79bcc15e1f0f..c1143ce9c3dc 100644 --- a/native/graphics/jni/imagedecoder.cpp +++ b/native/graphics/jni/imagedecoder.cpp @@ -325,11 +325,9 @@ int AImageDecoder_decodeImage(AImageDecoder* decoder, ImageDecoder* imageDecoder = toDecoder(decoder); - const int height = imageDecoder->getOutputInfo().height(); - const size_t minStride = AImageDecoder_getMinimumStride(decoder); - // If this calculation were to overflow, it would have been caught in - // setTargetSize. - if (stride < minStride || size < stride * (height - 1) + minStride) { + SkImageInfo info = imageDecoder->getOutputInfo(); + size_t minSize = info.computeByteSize(stride); + if (SkImageInfo::ByteSizeOverflowed(minSize) || size < minSize || !info.validRowBytes(stride)) { return ANDROID_IMAGE_DECODER_BAD_PARAMETER; } |