diff --git a/src/dec/buffer.c b/src/dec/buffer.c index 42feac74..6272424f 100644 --- a/src/dec/buffer.c +++ b/src/dec/buffer.c @@ -67,7 +67,9 @@ static VP8StatusCode CheckDecBuffer(const WebPDecBuffer* const buffer) { } else { // RGB checks const WebPRGBABuffer* const buf = &buffer->u.RGBA; const int stride = abs(buf->stride); - const uint64_t size = (uint64_t)stride * height; + // strictly speaking, the very last (or first, if flipped) row + // doesn't require padding. + const uint64_t size = (uint64_t)stride * (height - 1) + width; ok &= (size <= buf->size); ok &= (stride >= width * kModeBpp[mode]); ok &= (buf->rgba != NULL);