Attempting to render a JPEG with xres and yres set to 1 fails.

We end up trying to scale the JPEG up 72 times and fail a malloc.

A better plan is to make the image handler disbelieve any xres or
yres values less than 72dpi. We take care to still preserve aspect
ratios etc.

5 files changed, 75 insertions, 12 deletions

diff --git a/include/mupdf/fitz/image.h b/include/mupdf/fitz/image.h
index 42b45508..22d87988 100644
--- a/include/mupdf/fitz/image.h
+++ b/include/mupdf/fitz/image.h
@@ -93,4 +93,6 @@ void fz_load_jxr_info(fz_context *ctx, unsigned char *data, int size, int *w, in
 int fz_load_tiff_subimage_count(fz_context *ctx, unsigned char *buf, int len);
 fz_pixmap *fz_load_tiff_subimage(fz_context *ctx, unsigned char *buf, int len, int subimage);
 
+void fz_image_get_sanitised_res(fz_image *image, int *xres, int *yres);
+
 #endif
diff --git a/source/cbz/mucbz.c b/source/cbz/mucbz.c
index 844613a3..9b548125 100644
--- a/source/cbz/mucbz.c
+++ b/source/cbz/mucbz.c
@@ -216,9 +216,12 @@ fz_rect *
 cbz_bound_page(cbz_document *doc, cbz_page *page, fz_rect *bbox)
 {
 	fz_image *image = page->image;
+	int xres, yres;
+
+	fz_image_get_sanitised_res(image, &xres, &yres);
 	bbox->x0 = bbox->y0 = 0;
-	bbox->x1 = image->w * DPI / image->xres;
-	bbox->y1 = image->h * DPI / image->yres;
+	bbox->x1 = image->w * DPI / xres;
+	bbox->y1 = image->h * DPI / yres;
 	return bbox;
 }
 
@@ -227,8 +230,12 @@ cbz_run_page(cbz_document *doc, cbz_page *page, fz_device *dev, const fz_matrix
 {
 	fz_matrix local_ctm = *ctm;
 	fz_image *image = page->image;
-	float w = image->w * DPI / image->xres;
-	float h = image->h * DPI / image->yres;
+	int xres, yres;
+	float w, h;
+
+	fz_image_get_sanitised_res(image, &xres, &yres);
+	w = image->w * DPI / xres;
+	h = image->h * DPI / yres;
 	fz_pre_scale(&local_ctm, w, h);
 	fz_fill_image(dev, image, &local_ctm, 1);
 }
diff --git a/source/fitz/image.c b/source/fitz/image.c
index 556e841b..09d39043 100644
--- a/source/fitz/image.c
+++ b/source/fitz/image.c
@@ -1,5 +1,7 @@
 #include "mupdf/fitz.h"
 
+#define SANE_DPI 72.0f
+
 fz_pixmap *
 fz_new_pixmap_from_image(fz_context *ctx, fz_image *image, int w, int h)
 {
@@ -542,3 +544,43 @@ fz_new_image_from_buffer(fz_context *ctx, fz_buffer *buffer)
 
 	return fz_new_image(ctx, w, h, 8, cspace, xres, yres, 0, 0, NULL, NULL, bc, NULL);
 }
+
+void
+fz_image_get_sanitised_res(fz_image *image, int *xres, int *yres)
+{
+	*xres = image->xres;
+	*yres = image->yres;
+	if (*xres < 0 || *yres < 0 || (*xres == 0 && *yres == 0))
+	{
+		/* If neither xres or yres is sane, pick a sane value */
+		*xres = SANE_DPI; *yres = SANE_DPI;
+	}
+	else if (*xres == 0)
+	{
+		*xres = *yres;
+	}
+	else if (*yres == 0)
+	{
+		*yres = *xres;
+	}
+
+	/* Scale xres and yres up until we get beleivable values */
+	if (*xres < SANE_DPI || *yres < SANE_DPI)
+	{
+		if (*xres == *yres)
+		{
+			*xres = SANE_DPI;
+			*yres = SANE_DPI;
+		}
+		else if (*xres < *yres)
+		{
+			*yres = *yres * SANE_DPI / *xres;
+			*xres = SANE_DPI;
+		}
+		else
+		{
+			*xres = *xres * SANE_DPI / *yres;
+			*yres = SANE_DPI;
+		}
+	}
+}
diff --git a/source/img/muimage.c b/source/img/muimage.c
index d545068f..7e0f56ab 100644
--- a/source/img/muimage.c
+++ b/source/img/muimage.c
@@ -105,9 +105,11 @@ fz_rect *
 image_bound_page(image_document *doc, image_page *page, fz_rect *bbox)
 {
 	fz_image *image = (fz_image *)page;
+	int xres, yres;
+	fz_image_get_sanitised_res(image, &xres, &yres);
 	bbox->x0 = bbox->y0 = 0;
-	bbox->x1 = image->w * DPI / image->xres;
-	bbox->y1 = image->h * DPI / image->yres;
+	bbox->x1 = image->w * DPI / xres;
+	bbox->y1 = image->h * DPI / yres;
 	return bbox;
 }
 
@@ -116,8 +118,11 @@ image_run_page(image_document *doc, image_page *page, fz_device *dev, const fz_m
 {
 	fz_matrix local_ctm = *ctm;
 	fz_image *image = (fz_image *)page;
-	float w = image->w * DPI / image->xres;
-	float h = image->h * DPI / image->yres;
+	int xres, yres;
+	float w, h;
+	fz_image_get_sanitised_res(image, &xres, &yres);
+	w = image->w * DPI / xres;
+	h = image->h * DPI / yres;
 	fz_pre_scale(&local_ctm, w, h);
 	fz_fill_image(dev, image, &local_ctm, 1);
 }
diff --git a/source/tiff/mutiff.c b/source/tiff/mutiff.c
index e2772f11..a48165bf 100644
--- a/source/tiff/mutiff.c
+++ b/source/tiff/mutiff.c
@@ -132,9 +132,12 @@ fz_rect *
 tiff_bound_page(tiff_document *doc, tiff_page *page, fz_rect *bbox)
 {
 	fz_image *image = page->image;
+	int xres, yres;
+
+	fz_image_get_sanitised_res(image, &xres, &yres);
 	bbox->x0 = bbox->y0 = 0;
-	bbox->x1 = image->w * DPI / image->xres;
-	bbox->y1 = image->h * DPI / image->yres;
+	bbox->x1 = image->w * DPI / xres;
+	bbox->y1 = image->h * DPI / yres;
 	return bbox;
 }
 
@@ -143,8 +146,12 @@ tiff_run_page(tiff_document *doc, tiff_page *page, fz_device *dev, const fz_matr
 {
 	fz_matrix local_ctm = *ctm;
 	fz_image *image = page->image;
-	float w = image->w * DPI / image->xres;
-	float h = image->h * DPI / image->yres;
+	int xres, yres;
+	float w, h;
+
+	fz_image_get_sanitised_res(image, &xres, &yres);
+	w = image->w * DPI / xres;
+	h = image->h * DPI / yres;
 	fz_pre_scale(&local_ctm, w, h);
 	fz_fill_image(dev, image, &local_ctm, 1);
 }