Index: src/images/SkImageDecoder_libico.cpp |
diff --git a/src/images/SkImageDecoder_libico.cpp b/src/images/SkImageDecoder_libico.cpp |
index cd8a292edc149d70f8cf46f6657e5df5052c0691..5240d09b8672dbdd1980b27bf7d959b8dbcb425f 100644 |
--- a/src/images/SkImageDecoder_libico.cpp |
+++ b/src/images/SkImageDecoder_libico.cpp |
@@ -159,7 +159,7 @@ SkImageDecoder::Result SkICOImageDecoder::onDecode(SkStream* stream, SkBitmap* b |
const size_t size = read4Bytes(buf, 14 + choice*16); //matters? |
const size_t offset = read4Bytes(buf, 18 + choice*16); |
// promote the sum to 64-bits to avoid overflow |
- if (((uint64_t)offset + size) > length) { |
+ if (offset > length || size > length || ((uint64_t)offset + size) > length) { |
return kFailure; |
} |