divergencetech / ethier

Golang and Solidity SDK to make Ethereum development ethier
MIT License
217 stars 23 forks source link

Image.alphaBlend has an overrun error when `fgStride` is greater than `type(uint8).max` #92

Open wattsyart opened 1 year ago

wattsyart commented 1 year ago

The first line of function alphaBlend(bytes memory backBgr, bytes memory foreAbgr, uint256 width, Rectangle memory rect) has a flaw, where the fgStride calculation will revert because Rectangle uses uint8, and xMin and xMax, when multiplied together, could be larger than a uint8.

For example, if xMax is 64, and xMin is 64, multiplication would overrun since the value will equal 256.

This line:

uint256 fgStride = (rect.xMax - rect.xMin) * 4;

Should be:

uint256 fgStride = uint256(rect.xMax - rect.xMin) * 4;