Index: third_party/libwebp/utils/utils.c |
diff --git a/third_party/libwebp/utils/utils.c b/third_party/libwebp/utils/utils.c |
index 673b7e284c3d0c8563dcfb315d6c4fccacf8754f..b1db2f9d6d53df36453d3f76403b6826fa3abd9b 100644 |
--- a/third_party/libwebp/utils/utils.c |
+++ b/third_party/libwebp/utils/utils.c |
@@ -19,7 +19,8 @@ extern "C" { |
//------------------------------------------------------------------------------ |
// Checked memory allocation |
-static int CheckSizeArguments(uint64_t nmemb, size_t size) { |
+// Returns 0 in case of overflow of nmemb * size. |
+static int CheckSizeArgumentsOverflow(uint64_t nmemb, size_t size) { |
const uint64_t total_size = nmemb * size; |
if (nmemb == 0) return 1; |
if ((uint64_t)size > WEBP_MAX_ALLOCABLE_MEMORY / nmemb) return 0; |
@@ -28,12 +29,14 @@ static int CheckSizeArguments(uint64_t nmemb, size_t size) { |
} |
void* WebPSafeMalloc(uint64_t nmemb, size_t size) { |
- if (!CheckSizeArguments(nmemb, size)) return NULL; |
+ if (!CheckSizeArgumentsOverflow(nmemb, size)) return NULL; |
+ assert(nmemb * size > 0); |
return malloc((size_t)(nmemb * size)); |
} |
void* WebPSafeCalloc(uint64_t nmemb, size_t size) { |
- if (!CheckSizeArguments(nmemb, size)) return NULL; |
+ if (!CheckSizeArgumentsOverflow(nmemb, size)) return NULL; |
+ assert(nmemb * size > 0); |
return calloc((size_t)nmemb, size); |
} |