Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 768a06e9 authored by Treehugger Robot's avatar Treehugger Robot Committed by Gerrit Code Review
Browse files

Merge "Fix integer overflow abort"

parents 59ed83cc 68b930c2
Loading
Loading
Loading
Loading
+16 −4
Original line number Diff line number Diff line
@@ -191,10 +191,22 @@ void FindAVCDimensions(
             frame_crop_top_offset, frame_crop_bottom_offset,
             cropUnitX, cropUnitY);

        *width -=
            (frame_crop_left_offset + frame_crop_right_offset) * cropUnitX;
        *height -=
            (frame_crop_top_offset + frame_crop_bottom_offset) * cropUnitY;

        // *width -= (frame_crop_left_offset + frame_crop_right_offset) * cropUnitX;
        if(__builtin_add_overflow(frame_crop_left_offset, frame_crop_right_offset, &frame_crop_left_offset) ||
            __builtin_mul_overflow(frame_crop_left_offset, cropUnitX, &frame_crop_left_offset) ||
            __builtin_sub_overflow(*width, frame_crop_left_offset, width) ||
            *width < 0) {
            *width = 0;
        }

        //*height -= (frame_crop_top_offset + frame_crop_bottom_offset) * cropUnitY;
        if(__builtin_add_overflow(frame_crop_top_offset, frame_crop_bottom_offset, &frame_crop_top_offset) ||
            __builtin_mul_overflow(frame_crop_top_offset, cropUnitY, &frame_crop_top_offset) ||
            __builtin_sub_overflow(*height, frame_crop_top_offset, height) ||
            *height < 0) {
            *height = 0;
        }
    }

    if (sarWidth != NULL) {