shithub: libvpx

Info  •  Files  •  Log  •  Branches

VP9: fix unsigned integer overflow in decoder.

The difference of two size_t variables.

Change-Id: I73f35cdafc2ba64a9ddaf855cc6a410cfb63b8da

--- a/vp9/decoder/vp9_decodeframe.c

+++ b/vp9/decoder/vp9_decodeframe.c

@@ -1528,7 +1528,7 @@

 static int compare_tile_buffers(const void *a, const void *b) {

   const TileBuffer *const buf1 = (const TileBuffer *)a;

   const TileBuffer *const buf2 = (const TileBuffer *)b;

-  return (int)(buf2->size - buf1->size);

+  return (int)((int64_t)buf2->size - buf1->size);

 }

 static const uint8_t *decode_tiles_mt(VP9Decoder *pbi, const uint8_t *data,