VP9: fix unsigned integer overflow in decoder.

The difference of two size_t variables.

Change-Id: I73f35cdafc2ba64a9ddaf855cc6a410cfb63b8da

diff --git a/vp9/decoder/vp9_decodeframe.c b/vp9/decoder/vp9_decodeframe.c
index d0e896c13fce71743cbcd56b8143298b0d9ee888..4fba2e74104f8c96de752709a97b67b561ea0e5c 100644 (file)
--- a/vp9/decoder/vp9_decodeframe.c
+++ b/vp9/decoder/vp9_decodeframe.c
@@ -1528,7 +1528,7 @@ static int tile_worker_hook(void *arg1, void *arg2) {
 static int compare_tile_buffers(const void *a, const void *b) {
   const TileBuffer *const buf1 = (const TileBuffer *)a;
   const TileBuffer *const buf2 = (const TileBuffer *)b;
-  return (int)(buf2->size - buf1->size);
+  return (int)((int64_t)buf2->size - buf1->size);
 }
 
 static const uint8_t *decode_tiles_mt(VP9Decoder *pbi, const uint8_t *data,