AImageDecoder: ensure that stride is pixel aligned
Bug: 147749998
Test: I902de3410c45a21cf27b48a02cdc5d514b7ada60
If the client uses a stride that is not pixel aligned, AImageDecoder
will crash internally trying to access the memory. Return a failure
instead of crashing. Rely on SkImageInfo to compute the minimum size
required, too.
Change-Id: Ia4d14d6209e6f4af74906ff43208fa83ac82cbcd
diff --git a/native/graphics/jni/imagedecoder.cpp b/native/graphics/jni/imagedecoder.cpp
index 5143967..c3b3bf3 100644
--- a/native/graphics/jni/imagedecoder.cpp
+++ b/native/graphics/jni/imagedecoder.cpp
@@ -289,11 +289,9 @@
ImageDecoder* imageDecoder = toDecoder(decoder);
- const int height = imageDecoder->getOutputInfo().height();
- const size_t minStride = AImageDecoder_getMinimumStride(decoder);
- // If this calculation were to overflow, it would have been caught in
- // setTargetSize.
- if (stride < minStride || size < stride * (height - 1) + minStride) {
+ SkImageInfo info = imageDecoder->getOutputInfo();
+ size_t minSize = info.computeByteSize(stride);
+ if (SkImageInfo::ByteSizeOverflowed(minSize) || size < minSize || !info.validRowBytes(stride)) {
return ANDROID_IMAGE_DECODER_BAD_PARAMETER;
}