Error check when jpeg loader return negative size

it is possible that tjPlaneWidth return -1 if it might invalid.

Let we check for tjPlaneSizeYUV, tjPlaneWidth and tjPlaneHeight return
negative value case, so we can avoid unsigned integer overflow error.

Change-Id: I11f2d0b7eec3797a923c18db4d952578ad7767aa
Signed-off-by: Eunki, Hong <eunkiki.hong@samsung.com>

diff --git a/dali/internal/imaging/common/loader-jpeg-turbo.cpp b/dali/internal/imaging/common/loader-jpeg-turbo.cpp
index 13a0489ba4be5f44a891eb78e4f0a6ffc97143c0..43b0a3364ca3787418f9ff0ffbb85d6adaed6396 100644 (file)
--- a/dali/internal/imaging/common/loader-jpeg-turbo.cpp
+++ b/dali/internal/imaging/common/loader-jpeg-turbo.cpp
@@ -893,6 +893,13 @@ bool DecodeJpeg(const Dali::ImageLoader::Input& input, std::vector<Dali::Devel::
     {
       auto planeSize = tjPlaneSizeYUV(i, scaledPostXformWidth, 0, scaledPostXformHeight, chrominanceSubsampling);
 
+      if(DALI_UNLIKELY(planeSize == static_cast<decltype(planeSize)>(-1)))
+      {
+        DALI_LOG_ERROR("Plane image for %d'th tjPlaneSizeYUV failed! planeSize : %lu\n", i, planeSize);
+        pixelBuffers.clear();
+        return false;
+      }
+
       uint8_t* buffer = static_cast<uint8_t*>(malloc(planeSize));
       if(DALI_UNLIKELY(!buffer))
       {
@@ -921,6 +928,14 @@ bool DecodeJpeg(const Dali::ImageLoader::Input& input, std::vector<Dali::Devel::
         pixelFormat = (i == 1 ? Pixel::CHROMINANCE_U : Pixel::CHROMINANCE_V);
       }
 
+      if(DALI_UNLIKELY(width <= 0 || height <= 0 || planeWidth <= 0))
+      {
+        DALI_LOG_ERROR("Plane image for %d'th size invalid! width : %d, height : %d, planeWidth : %d\n", i, width, height, planeWidth);
+        pixelBuffers.clear();
+        free(buffer);
+        return false;
+      }
+
       Internal::Adaptor::PixelBufferPtr internal = Internal::Adaptor::PixelBuffer::New(buffer, planeSize, width, height, planeWidth * Pixel::GetBytesPerPixel(pixelFormat), pixelFormat);
       Dali::Devel::PixelBuffer          bitmap   = Devel::PixelBuffer(internal.Get());
       planes[i]                                  = buffer;