Skip to content

Image.alphaBlend has an overrun error when fgStride is greater than type(uint8).max #92

Description

@wattsyart

The first line of function alphaBlend(bytes memory backBgr, bytes memory foreAbgr, uint256 width, Rectangle memory rect) has a flaw, where the fgStride calculation will revert because Rectangle uses uint8, and xMin and xMax, when multiplied together, could be larger than a uint8.

For example, if xMax is 64, and xMin is 64, multiplication would overrun since the value will equal 256.

This line:

uint256 fgStride = (rect.xMax - rect.xMin) * 4;

Should be:

uint256 fgStride = uint256(rect.xMax - rect.xMin) * 4; 

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions