Bug 1694670. Fix the OOB check in write_u32/u16. r=aosmond
authorJeff Muizelaar <jmuizelaar@mozilla.com>
Thu, 25 Feb 2021 13:18:47 +0000 (2021-02-25)
changeset 568753 95fc70920b71afdd5ea6a411cbb3519064ed3cbc
parent 568752 4bfa179974339d5b987f70981eb355ec0ab9e072
child 568754 7cfc3b6d8a50fffac1872e6ada4ea8fffff5fb37
push id38238
push usercsabou@mozilla.com
push dateThu, 25 Feb 2021 21:52:15 +0000 (2021-02-25)
treeherdermozilla-central@a6f0e34af589 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersaosmond
bugs1694670
milestone88.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1694670. Fix the OOB check in write_u32/u16. r=aosmond Differential Revision: https://phabricator.services.mozilla.com/D106362
gfx/qcms/src/iccread.rs
--- a/gfx/qcms/src/iccread.rs
+++ b/gfx/qcms/src/iccread.rs
@@ -224,26 +224,26 @@ fn read_s15Fixed16Number(mem: &mut MemSo
 }
 fn read_uInt8Number(mem: &mut MemSource, offset: usize) -> uInt8Number {
     read_u8(mem, offset)
 }
 fn read_uInt16Number(mem: &mut MemSource, offset: usize) -> uInt16Number {
     read_u16(mem, offset)
 }
 pub fn write_u32(mem: &mut [u8], offset: usize, value: u32) {
-    if offset <= mem.len() - std::mem::size_of_val(&value) {
+    if offset > mem.len() - std::mem::size_of_val(&value) {
         panic!("OOB");
     }
     let mem = mem.as_mut_ptr();
     unsafe {
         std::ptr::write_unaligned(mem.add(offset) as *mut u32, cpu_to_be32(value));
     }
 }
 pub fn write_u16(mem: &mut [u8], offset: usize, value: u16) {
-    if offset <= mem.len() - std::mem::size_of_val(&value) {
+    if offset > mem.len() - std::mem::size_of_val(&value) {
         panic!("OOB");
     }
     let mem = mem.as_mut_ptr();
     unsafe {
         std::ptr::write_unaligned(mem.add(offset) as *mut u16, cpu_to_be16(value));
     }
 }