commit a4a8be37482d804c857f3b34ec63b0fef6415e3f
author TreeHugger Robot <treehugger-gerrit@google.com> Mon Jan 27 16:06:27 2020 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Mon Jan 27 16:06:27 2020 +0000
tree 04ce277941030ccc50bd97026b6016632d299422
parent 992ba2ddd30a0db10b511379169d0392b17d37a6
parent d894c59881d1172f98981fa0da7a675cbd7130b8

Merge "AImageDecoder: ensure that stride is pixel aligned"

native/graphics/jni/imagedecoder.cpp

diff --git a/native/graphics/jni/imagedecoder.cpp b/native/graphics/jni/imagedecoder.cpp
index 79bcc15..c1143ce 100644
--- a/native/graphics/jni/imagedecoder.cpp
+++ b/native/graphics/jni/imagedecoder.cpp
@@ -325,11 +325,9 @@
 
     ImageDecoder* imageDecoder = toDecoder(decoder);
 
-    const int height = imageDecoder->getOutputInfo().height();
-    const size_t minStride = AImageDecoder_getMinimumStride(decoder);
-    // If this calculation were to overflow, it would have been caught in
-    // setTargetSize.
-    if (stride < minStride || size < stride * (height - 1) + minStride) {
+    SkImageInfo info = imageDecoder->getOutputInfo();
+    size_t minSize = info.computeByteSize(stride);
+    if (SkImageInfo::ByteSizeOverflowed(minSize) || size < minSize || !info.validRowBytes(stride)) {
         return ANDROID_IMAGE_DECODER_BAD_PARAMETER;
     }