| Index: src/images/SkImageDecoder_libico.cpp
|
| diff --git a/src/images/SkImageDecoder_libico.cpp b/src/images/SkImageDecoder_libico.cpp
|
| index cd8a292edc149d70f8cf46f6657e5df5052c0691..5240d09b8672dbdd1980b27bf7d959b8dbcb425f 100644
|
| --- a/src/images/SkImageDecoder_libico.cpp
|
| +++ b/src/images/SkImageDecoder_libico.cpp
|
| @@ -159,7 +159,7 @@ SkImageDecoder::Result SkICOImageDecoder::onDecode(SkStream* stream, SkBitmap* b
|
| const size_t size = read4Bytes(buf, 14 + choice*16); //matters?
|
| const size_t offset = read4Bytes(buf, 18 + choice*16);
|
| // promote the sum to 64-bits to avoid overflow
|
| - if (((uint64_t)offset + size) > length) {
|
| + if (offset > length || size > length || ((uint64_t)offset + size) > length) {
|
| return kFailure;
|
| }
|
|
|
|
|