libwebp: fix some int <-> size_t mix for buffer sizes

third_party/libwebp/dec/buffer.c

 // Copyright 2011 Google Inc.
 //
 // This code is licensed under the same terms as WebM:
 //  Software License Agreement:  http://www.webmproject.org/license/software/
 //  Additional IP Rights Grant:  http://www.webmproject.org/license/additional/
 // -----------------------------------------------------------------------------
 //
 // Everything about WebPDecBuffer
 //
 // Author: Skal (pascal.massimino@gmail.com)
@@ skipping 12 matching lines @@
 // Number of bytes per pixel for the different color-spaces.
 static const int kModeBpp[MODE_LAST] = { 3, 4, 3, 4, 4, 2, 2, 1, 1 };
 
 static VP8StatusCode CheckDecBuffer(const WebPDecBuffer* const buffer) {
   int ok = 1;
   WEBP_CSP_MODE mode = buffer->colorspace;
   const int width = buffer->width;
   const int height = buffer->height;
   if (mode >= MODE_YUV) {   // YUV checks
     const WebPYUVABuffer* const buf = &buffer->u.YUVA;
-    const int size = buf->y_stride * height;
-    const int u_size = buf->u_stride * ((height + 1) / 2);
-    const int v_size = buf->v_stride * ((height + 1) / 2);
-    const int a_size = buf->a_stride * height;
-    ok &= (size <= buf->y_size);
+    const uint64_t y_size = (uint64_t)buf->y_stride * height;
+    const uint64_t u_size = (uint64_t)buf->u_stride * ((height + 1) / 2);
+    const uint64_t v_size = (uint64_t)buf->v_stride * ((height + 1) / 2);
+    const uint64_t a_size = (uint64_t)buf->a_stride * height;
+    ok &= (y_size <= buf->y_size);
     ok &= (u_size <= buf->u_size);
     ok &= (v_size <= buf->v_size);
     ok &= (a_size <= buf->a_size);
     ok &= (buf->y_stride >= width);
     ok &= (buf->u_stride >= (width + 1) / 2);
     ok &= (buf->v_stride >= (width + 1) / 2);
     if (buf->a) {
       ok &= (buf->a_stride >= width);
     }
   } else {    // RGB checks
     const WebPRGBABuffer* const buf = &buffer->u.RGBA;
-    ok &= (buf->stride * height <= buf->size);
+    const uint64_t size = (uint64_t)buf->stride * height;
+    ok &= (size <= buf->size);
     ok &= (buf->stride >= width * kModeBpp[mode]);
   }
   return ok ? VP8_STATUS_OK : VP8_STATUS_INVALID_PARAM;
 }
 
 static VP8StatusCode AllocateBuffer(WebPDecBuffer* const buffer) {
   const int w = buffer->width;
   const int h = buffer->height;
 
   if (w <= 0 || h <= 0) {
@@ skipping 28 matching lines @@
 
     buffer->private_memory = output = (uint8_t*)malloc((size_t)total_size);
     if (output == NULL) {
       return VP8_STATUS_OUT_OF_MEMORY;
     }
 
     if (mode >= MODE_YUV) {   // YUVA initialization
       WebPYUVABuffer* const buf = &buffer->u.YUVA;
       buf->y = output;
       buf->y_stride = stride;
-      buf->y_size = (int)size;
+      buf->y_size = (size_t)size;
       buf->u = output + size;
       buf->u_stride = uv_stride;
-      buf->u_size = (int)uv_size;
+      buf->u_size = (size_t)uv_size;
       buf->v = output + size + uv_size;
       buf->v_stride = uv_stride;
-      buf->v_size = (int)uv_size;
+      buf->v_size = (size_t)uv_size;
       if (mode == MODE_YUVA) {
         buf->a = output + size + 2 * uv_size;
       }
-      buf->a_size = (int)a_size;
+      buf->a_size = (size_t)a_size;
       buf->a_stride = a_stride;
     } else {  // RGBA initialization
       WebPRGBABuffer* const buf = &buffer->u.RGBA;
       buf->rgba = output;
       buf->stride = stride;
-      buf->size = (int)size;
+      buf->size = (size_t)size;
     }
   }
   return CheckDecBuffer(buffer);
 }
 
 VP8StatusCode WebPAllocateDecBuffer(int w, int h,
                                     const WebPDecoderOptions* const options,
                                     WebPDecBuffer* const out) {
   if (out == NULL || w <= 0 || h <= 0) {
     return VP8_STATUS_INVALID_PARAM;
@@ skipping 63 matching lines @@
       src->private_memory = NULL;
     }
   }
 }
 
 //------------------------------------------------------------------------------
 
 #if defined(__cplusplus) || defined(c_plusplus)
 }    // extern "C"
 #endif