Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d894c598 authored by Leon Scroggins III's avatar Leon Scroggins III
Browse files

AImageDecoder: ensure that stride is pixel aligned 

Bug: 147749998
Test: I902de3410c45a21cf27b48a02cdc5d514b7ada60

If the client uses a stride that is not pixel aligned, AImageDecoder
will crash internally trying to access the memory. Return a failure
instead of crashing. Rely on SkImageInfo to compute the minimum size
required, too.

Change-Id: Ia4d14d6209e6f4af74906ff43208fa83ac82cbcd
parent 380f3c9a

native/graphics/jni/imagedecoder.cpp

+3 −5
Original line number Diff line number Diff line
@@ -289,11 +289,9 @@ int AImageDecoder_decodeImage(AImageDecoder* decoder, 


    ImageDecoder* imageDecoder = toDecoder(decoder);



    const int height = imageDecoder->getOutputInfo().height();

    const size_t minStride = AImageDecoder_getMinimumStride(decoder);

    // If this calculation were to overflow, it would have been caught in

    // setTargetSize.

    if (stride < minStride || size < stride * (height - 1) + minStride) {

    SkImageInfo info = imageDecoder->getOutputInfo();

    size_t minSize = info.computeByteSize(stride);

    if (SkImageInfo::ByteSizeOverflowed(minSize) || size < minSize || !info.validRowBytes(stride)) {

        return ANDROID_IMAGE_DECODER_BAD_PARAMETER;

    }