From: Jerome Jiang <jianj@google.com>
Date: Thu, 24 May 2018 21:07:28 +0000 (-0700)
Subject: VP9: fix unsigned integer overflow in decoder.
X-Git-Tag: v1.8.0~636^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=84a9e8eb9a577cb42acf095d0d22b64e416ef61d;p=libvpx

VP9: fix unsigned integer overflow in decoder.

The difference of two size_t variables.

Change-Id: I73f35cdafc2ba64a9ddaf855cc6a410cfb63b8da
---

diff --git a/vp9/decoder/vp9_decodeframe.c b/vp9/decoder/vp9_decodeframe.c
index d0e896c13..4fba2e741 100644
--- a/vp9/decoder/vp9_decodeframe.c
+++ b/vp9/decoder/vp9_decodeframe.c
@@ -1528,7 +1528,7 @@ static int tile_worker_hook(void *arg1, void *arg2) {
 static int compare_tile_buffers(const void *a, const void *b) {
   const TileBuffer *const buf1 = (const TileBuffer *)a;
   const TileBuffer *const buf2 = (const TileBuffer *)b;
-  return (int)(buf2->size - buf1->size);
+  return (int)((int64_t)buf2->size - buf1->size);
 }
 
 static const uint8_t *decode_tiles_mt(VP9Decoder *pbi, const uint8_t *data,