diff options
| author | Bo Xu <bo_xu@foxitsoftware.com> | 2014-08-27 16:01:41 -0700 |
|---|---|---|
| committer | Bo Xu <bo_xu@foxitsoftware.com> | 2014-09-26 14:38:54 -0700 |
| commit | dc23d4dc3fd4914915e0c77ec28d8735de654c8b (patch) | |
| tree | 6263b81eaaaade4642178f84c8d61556ce5c5f30 | |
| parent | b66846417ff38bc88b21f3f8c764936928eebac8 (diff) | |
| download | pdfium-dc23d4dc3fd4914915e0c77ec28d8735de654c8b.tar.xz | |
Restrict index not be greater than row_size in TIFF_PredictLine
There is not strict way to limit invalid value of |Colors| from dictionary. We can make sure |index| does not go out of boundary of row_size.
BUG=407614
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/509993003
| -rw-r--r-- | core/src/fxcodec/codec/fx_codec_flate.cpp | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/core/src/fxcodec/codec/fx_codec_flate.cpp b/core/src/fxcodec/codec/fx_codec_flate.cpp index a12fffbe5c..e17c32a2c7 100644 --- a/core/src/fxcodec/codec/fx_codec_flate.cpp +++ b/core/src/fxcodec/codec/fx_codec_flate.cpp @@ -524,17 +524,19 @@ static void TIFF_PredictorEncode(FX_LPBYTE& data_buf, FX_DWORD& data_size, static void TIFF_PredictLine(FX_LPBYTE dest_buf, int row_size, int BitsPerComponent, int Colors, int Columns) { if (BitsPerComponent == 1) { - int row_bits = BitsPerComponent * Colors * Columns; + int row_bits = FX_MIN(BitsPerComponent * Colors * Columns, row_size * 8); + int index_pre = 0; + int col_pre = 0; for(int i = 1; i < row_bits; i ++) { int col = i % 8; int index = i / 8; - int index_pre = (col == 0) ? (index - 1) : index; - int col_pre = (col == 0) ? 8 : col; - if( ((dest_buf[index] >> (7 - col)) & 1) ^ ((dest_buf[index_pre] >> (8 - col_pre)) & 1) ) { + if( ((dest_buf[index] >> (7 - col)) & 1) ^ ((dest_buf[index_pre] >> (7 - col_pre)) & 1) ) { dest_buf[index] |= 1 << (7 - col); } else { dest_buf[index] &= ~(1 << (7 - col)); } + index_pre = index; + col_pre = col; } return; } |