Bug 1694670. Fix the OOB check in write_u32/u16. r=aosmond, a=pascalc
authorJeff Muizelaar <jmuizelaar@mozilla.com>
Thu, 25 Feb 2021 13:18:47 +0000 (2021-02-25)
changeset 635507 fdc6e37202db6e9cbdb1318511119c6c49132b71
parent 635506 9919920c48443ba08ba885f52ed8d4441ec08b68
child 635508 b080dea7fdb7518256a90f0e600b017c96e58fdf
push id2530
push userryanvm@gmail.com
push dateWed, 10 Mar 2021 15:23:36 +0000 (2021-03-10)
treeherdermozilla-release@79d854522120 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersaosmond, pascalc
bugs1694670
milestone86.0.1
Bug 1694670. Fix the OOB check in write_u32/u16. r=aosmond, a=pascalc Differential Revision: https://phabricator.services.mozilla.com/D106362
gfx/qcms/src/iccread.rs
--- a/gfx/qcms/src/iccread.rs
+++ b/gfx/qcms/src/iccread.rs
@@ -224,26 +224,26 @@ fn read_s15Fixed16Number(mem: &mut MemSo
 }
 fn read_uInt8Number(mem: &mut MemSource, offset: usize) -> uInt8Number {
     read_u8(mem, offset)
 }
 fn read_uInt16Number(mem: &mut MemSource, offset: usize) -> uInt16Number {
     read_u16(mem, offset)
 }
 pub fn write_u32(mem: &mut [u8], offset: usize, value: u32) {
-    if offset <= mem.len() - std::mem::size_of_val(&value) {
+    if offset > mem.len() - std::mem::size_of_val(&value) {
         panic!("OOB");
     }
     let mem = mem.as_mut_ptr();
     unsafe {
         std::ptr::write_unaligned(mem.add(offset) as *mut u32, cpu_to_be32(value));
     }
 }
 pub fn write_u16(mem: &mut [u8], offset: usize, value: u16) {
-    if offset <= mem.len() - std::mem::size_of_val(&value) {
+    if offset > mem.len() - std::mem::size_of_val(&value) {
         panic!("OOB");
     }
     let mem = mem.as_mut_ptr();
     unsafe {
         std::ptr::write_unaligned(mem.add(offset) as *mut u16, cpu_to_be16(value));
     }
 }