Bug 1279413 - pixman: avoid overflow in create_bits function. r=milan, a=sylvestre
authorJeff Muizelaar <jmuizelaar@mozilla.com>
Wed, 22 Jun 2016 20:52:31 -0400
changeset 341987 7827e7019cb9308b10faacda143ddb34dd1f7a27
parent 341986 0eda20ce81496c7d64fc9bb9851bcfaa3e764a50
child 341988 1ee8ca4958a5fd7c5bf6126984314e0587b8a2c0
push id1183
push userraliiev@mozilla.com
push dateMon, 05 Sep 2016 20:01:49 +0000
treeherdermozilla-release@3148731bed45 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmilan, sylvestre
bugs1279413, 3244
milestone49.0a2
Bug 1279413 - pixman: avoid overflow in create_bits function. r=milan, a=sylvestre This is from the upstream: https://lists.freedesktop.org/archives/pixman/2014-April/003244.html
gfx/cairo/libpixman/src/pixman-bits-image.c
--- a/gfx/cairo/libpixman/src/pixman-bits-image.c
+++ b/gfx/cairo/libpixman/src/pixman-bits-image.c
@@ -1731,17 +1731,17 @@ create_bits (pixman_format_code_t format
     stride += 0x1f;
     stride >>= 5;
 
     stride *= sizeof (uint32_t);
 
     if (_pixman_multiply_overflows_size (height, stride))
 	return NULL;
 
-    buf_size = height * stride;
+    buf_size = (size_t)height * stride;
 
     if (rowstride_bytes)
 	*rowstride_bytes = stride;
 
     if (clear)
 	return calloc (buf_size, 1);
     else
 	return malloc (buf_size);