diff --git a/plugins/common/libs/image/libgifplugin/src/gif_encoder.cpp b/plugins/common/libs/image/libgifplugin/src/gif_encoder.cpp index c2ae6b1cdb0fb46b413fbdf0b0a747363aacc489..603c95ab2e4eb319a57a1ca83e4dfbce73a48c27 100644 --- a/plugins/common/libs/image/libgifplugin/src/gif_encoder.cpp +++ b/plugins/common/libs/image/libgifplugin/src/gif_encoder.cpp @@ -52,6 +52,8 @@ const int FIRST_CODE = 4097; const int DISPOSAL_METHOD_SHIFT_BIT = 2; const uint32_t DEFAULT_DELAY_TIME = 100; const uint32_t DEFAULT_DISPOSAL_TYPE = 1; +const uint16_t MAX_UINT16 = 65535; +const uint32_t MAX_UINT16_SQUARED = static_cast(MAX_UINT16) * MAX_UINT16; const uint8_t GIF89_STAMP[] = {0x47, 0x49, 0x46, 0x38, 0x39, 0x61}; const uint8_t APPLICATION_IDENTIFIER[] = {0x4E, 0x45, 0x54, 0x53, 0x43, 0x41, 0x50, 0x45}; @@ -376,25 +378,26 @@ uint32_t GifEncoder::separateRGBA(int index, uint16_t width, uint16_t height, return SUCCESS; } -void InitColorCube(ColorCoordinate *colorCoordinate, uint16_t width, uint16_t height, +bool InitColorCube(ColorCoordinate *colorCoordinate, uint16_t width, uint16_t height, ColorInput *colorInput) { + uint32_t imageSize = static_cast(width) * height; + bool isInValidSize = width == 0 || height == 0 || imageSize > MAX_UINT16_SQUARED; + CHECK_ERROR_RETURN_RET_LOG(isInValidSize, false, + "%{public}s Invalid width:%{public}d, height:%{public}d.", __func__, width, height); for (int i = 0; i < COLOR_ARRAY_SIZE; i++) { colorCoordinate[i].rgb[R_IN_RGB] = (static_cast(i) >> RED_COORDINATE) & 0x1F; colorCoordinate[i].rgb[G_IN_RGB] = (static_cast(i) >> GREEN_COORDINATE) & 0x1F; colorCoordinate[i].rgb[B_IN_RGB] = (static_cast(i) >> BLUE_COORDINATE) & 0x1F; colorCoordinate[i].pixelNum = 0; } - int imageSize = static_cast(width * height); - if (imageSize < 0) { - return; - } - for (int i = 0; i < imageSize; i++) { + for (uint32_t i = 0; i < imageSize; i++) { uint16_t index = ((colorInput->redInput[i] >> (BITS_IN_BYTE - BITS_PER_PRIM_COLOR)) << RED_COORDINATE) + ((colorInput->greenInput[i] >> (BITS_IN_BYTE - BITS_PER_PRIM_COLOR)) << GREEN_COORDINATE) + ((colorInput->blueInput[i] >> (BITS_IN_BYTE - BITS_PER_PRIM_COLOR)) << BLUE_COORDINATE); colorCoordinate[index].pixelNum++; } + return true; } void InitColorSubdivMap(ColorSubdivMap* colorSubdivMap, int32_t colorSubdivMapSize, uint16_t width, uint16_t height) @@ -472,7 +475,11 @@ uint32_t GifEncoder::doColorQuantize(uint16_t width, uint16_t height, colorInput.redInput = redInput; colorInput.greenInput = greenInput; colorInput.blueInput = blueInput; - InitColorCube(colorCoordinate, width, height, &colorInput); + if (!InitColorCube(colorCoordinate, width, height, &colorInput)) { + IMAGE_LOGE("Failed to initialize color cube."); + free(colorCoordinate); + return ERR_IMAGE_ENCODE_FAILED; + } InitColorSubdivMap(colorSubdivMap, COLOR_OF_GIF, width, height); InitForQuantize(colorCoordinate, colorSubdivMap); if (BuildColorSubdivMap(colorSubdivMap, &colorSubdivMapSize)) {