diff options
| author | npm <npm@chromium.org> | 2016-11-22 13:15:20 -0800 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2016-11-22 13:15:20 -0800 |
| commit | 5048731cf0b1221a81e76d7f6e95f24159bb87e2 (patch) | |
| tree | 687e3f944a45f906db586d6a2e261a39ad5e9246 | |
| parent | c675a2f4afdd7e54bc4b4638bd1ffcb2de0b7124 (diff) | |
| download | pdfium-5048731cf0b1221a81e76d7f6e95f24159bb87e2.tar.xz | |
Multiply safely in CCodec_TiffContext::Decode
BUG=667074
Review-Url: https://codereview.chromium.org/2520253003
| -rw-r--r-- | core/fxcodec/codec/fx_codec_tiff.cpp | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/core/fxcodec/codec/fx_codec_tiff.cpp b/core/fxcodec/codec/fx_codec_tiff.cpp index c4c745587f..8046f1cc39 100644 --- a/core/fxcodec/codec/fx_codec_tiff.cpp +++ b/core/fxcodec/codec/fx_codec_tiff.cpp @@ -447,7 +447,11 @@ bool CCodec_TiffContext::Decode(CFX_DIBitmap* pDIBitmap) { uint16_t bps = 0; TIFFGetField(m_tif_ctx, TIFFTAG_SAMPLESPERPIXEL, &spp); TIFFGetField(m_tif_ctx, TIFFTAG_BITSPERSAMPLE, &bps); - uint32_t bpp = bps * spp; + FX_SAFE_UINT32 safe_bpp = bps; + safe_bpp *= spp; + if (!safe_bpp.IsValid()) + return false; + uint32_t bpp = safe_bpp.ValueOrDie(); if (bpp == 1) return Decode1bppRGB(pDIBitmap, height, width, bps, spp); if (bpp <= 8) |