summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLei Zhang <thestig@chromium.org>2015-10-02 11:10:17 -0700
committerLei Zhang <thestig@chromium.org>2015-10-02 11:10:17 -0700
commit9dd3dc19a1ddb6c0a6fc61ee185363591a571b98 (patch)
tree2da3cdb4189429a51e06cb7d6cd9a192c6a2ad7a
parentdb12c167d3613c9a73b28cac75e37779dbc680e0 (diff)
downloadpdfium-9dd3dc19a1ddb6c0a6fc61ee185363591a571b98.tar.xz
Merge to XFA: Fix PNG decoding divide by zero error due to zero row count.
BUG=537790 TBR=tsepez@chromium.org Review URL: https://codereview.chromium.org/1379243002 . (cherry picked from commit 095a83c59120c108d9ac6f0ab71fd3faa5eea810) Review URL: https://codereview.chromium.org/1380563003 .
-rw-r--r--core/src/fxcodec/codec/fx_codec_flate.cpp2
1 files changed, 2 insertions, 0 deletions
diff --git a/core/src/fxcodec/codec/fx_codec_flate.cpp b/core/src/fxcodec/codec/fx_codec_flate.cpp
index e8878e4535..37aecf106d 100644
--- a/core/src/fxcodec/codec/fx_codec_flate.cpp
+++ b/core/src/fxcodec/codec/fx_codec_flate.cpp
@@ -400,6 +400,8 @@ static FX_BOOL PNG_Predictor(uint8_t*& data_buf,
if (row_size <= 0)
return FALSE;
const int row_count = (data_size + row_size) / (row_size + 1);
+ if (row_count <= 0)
+ return FALSE;
const int last_row_size = data_size % (row_size + 1);
uint8_t* dest_buf = FX_Alloc2D(uint8_t, row_size, row_count);
int byte_cnt = 0;