summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorOliver Chang <ochang@chromium.org>2015-11-24 12:35:02 -0800
committerOliver Chang <ochang@chromium.org>2015-11-24 12:35:02 -0800
commit9c2b4ad8e3bfb3e748874bdfda3f265f0972cfd6 (patch)
treedbc4e7e871e4de910c7a98a0b52ed798f62cca1e
parente668838baf79ff8bc0e13931feea5cd1877706eb (diff)
downloadpdfium-chromium/2526.tar.xz
Merge to M47: Add a missing setjmp() to CCodec_JpegDecoder::v_GetNextLine().chromium/2526
If jpeg_read_scanlines() ends up calling the error callback, we longjmp into some undefined state. BUG=558840 TBR=thestig@chromium.org Original Review URL: https://codereview.chromium.org/1463563003 . (cherry picked from commit 06e33aec03f13c76d9eff5c09cb03e142b0c5ef1) Review URL: https://codereview.chromium.org/1471913005 .
-rw-r--r--core/src/fxcodec/codec/fx_codec_jpeg.cpp6
1 files changed, 5 insertions, 1 deletions
diff --git a/core/src/fxcodec/codec/fx_codec_jpeg.cpp b/core/src/fxcodec/codec/fx_codec_jpeg.cpp
index 0a38fc82ca..76096f36b5 100644
--- a/core/src/fxcodec/codec/fx_codec_jpeg.cpp
+++ b/core/src/fxcodec/codec/fx_codec_jpeg.cpp
@@ -502,9 +502,13 @@ uint8_t* CCodec_JpegDecoder::v_GetNextLine() {
if (m_pExtProvider) {
return m_pExtProvider->GetNextLine(m_pExtContext);
}
+
+ if (setjmp(m_JmpBuf) == -1)
+ return nullptr;
+
int nlines = jpeg_read_scanlines(&cinfo, &m_pScanlineBuf, 1);
if (nlines < 1) {
- return NULL;
+ return nullptr;
}
return m_pScanlineBuf;
}