From 229d05df5bc5deb3890b26b614113c25d9b6935e Mon Sep 17 00:00:00 2001 From: weili Date: Thu, 11 Aug 2016 19:43:58 -0700 Subject: Fix an integer overflow in CStretchEngine constructor When the source bitmap's width and height are large, the multiplication could easily overflow a signed integer. Change to use 'long long' type for calculation to avoid that. BUG=chromium:635663 Review-Url: https://codereview.chromium.org/2240723002 --- core/fxge/dib/fx_dib_engine.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'core/fxge/dib/fx_dib_engine.cpp') diff --git a/core/fxge/dib/fx_dib_engine.cpp b/core/fxge/dib/fx_dib_engine.cpp index 520148fc77..88b0d4b271 100644 --- a/core/fxge/dib/fx_dib_engine.cpp +++ b/core/fxge/dib/fx_dib_engine.cpp @@ -306,8 +306,8 @@ CStretchEngine::CStretchEngine(IFX_ScanlineComposer* pDestBitmap, FX_BOOL bInterpol = flags & FXDIB_INTERPOL || flags & FXDIB_BICUBIC_INTERPOL; if (!bInterpol && FXSYS_abs(dest_width) != 0 && - FXSYS_abs(dest_height) < - m_SrcWidth * m_SrcHeight * 8 / FXSYS_abs(dest_width)) { + FXSYS_abs(dest_height) / 8 < static_cast(m_SrcWidth) * + m_SrcHeight / FXSYS_abs(dest_width)) { flags = FXDIB_INTERPOL; } m_Flags = flags; -- cgit v1.2.3