Bug 1694670. Fix the OOB check in write_u32/u16. r=aosmond, a=pascalc
Differential Revision:
https://phabricator.services.mozilla.com/D106362
--- a/gfx/qcms/src/iccread.rs
+++ b/gfx/qcms/src/iccread.rs
@@ -224,26 +224,26 @@ fn read_s15Fixed16Number(mem: &mut MemSo
}
fn read_uInt8Number(mem: &mut MemSource, offset: usize) -> uInt8Number {
read_u8(mem, offset)
}
fn read_uInt16Number(mem: &mut MemSource, offset: usize) -> uInt16Number {
read_u16(mem, offset)
}
pub fn write_u32(mem: &mut [u8], offset: usize, value: u32) {
- if offset <= mem.len() - std::mem::size_of_val(&value) {
+ if offset > mem.len() - std::mem::size_of_val(&value) {
panic!("OOB");
}
let mem = mem.as_mut_ptr();
unsafe {
std::ptr::write_unaligned(mem.add(offset) as *mut u32, cpu_to_be32(value));
}
}
pub fn write_u16(mem: &mut [u8], offset: usize, value: u16) {
- if offset <= mem.len() - std::mem::size_of_val(&value) {
+ if offset > mem.len() - std::mem::size_of_val(&value) {
panic!("OOB");
}
let mem = mem.as_mut_ptr();
unsafe {
std::ptr::write_unaligned(mem.add(offset) as *mut u16, cpu_to_be16(value));
}
}