swftools
swftools copied to clipboard
Integer overflow occurs when extracting large lossless image with swfextract.
See here for the outline. https://github.com/matthiaskramm/swftools/pull/71
int = signed 32-bit environment, this might be a bad thing.
datalen = (width*height*bpp/8+cols*8);
do {
if(data)
width*height*bpp => 7083 * 9744 * 32 => 0x83A39600 =(signed) => -2086431232
datalen can be calculated accurately from the information of lossless tag, the current process of iterating malloc & uncompress (start from a rough estimate) is not good.
I suggested this bug fix in this PR. https://github.com/matthiaskramm/swftools/pull/152