From 0dde72e47e7d165e2d725d0ce6b7e4ec0679597a Mon Sep 17 00:00:00 2001 From: MarkLee131 Date: Sun, 29 Mar 2026 18:03:31 +0800 Subject: [PATCH] Fix copy-paste error in WebPImage::inject_VP8X height check Line 773 checks width > 0 instead of height > 0. This was introduced in commit bf151a17a. When height is 0, the enforce does not catch it and height - 1 wraps as an unsigned integer. Change the check to validate height instead of width. --- src/webpimage.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/webpimage.cpp b/src/webpimage.cpp index c4c722013c..3175ddc878 100644 --- a/src/webpimage.cpp +++ b/src/webpimage.cpp @@ -770,7 +770,7 @@ void WebPImage::inject_VP8X(BasicIo& iIo, bool has_xmp, bool has_exif, bool has_ data[6] = (w >> 16) & 0xFF; /* set height - stored in 24bits */ - Internal::enforce(width > 0, Exiv2::ErrorCode::kerCorruptedMetadata); + Internal::enforce(height > 0, Exiv2::ErrorCode::kerCorruptedMetadata); uint32_t h = height - 1; data[7] = h & 0xFF; data[8] = (h >> 8) & 0xFF;