summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNicolas Pena <npm@chromium.org>2017-02-17 13:15:02 -0500
committerChromium commit bot <commit-bot@chromium.org>2017-02-17 19:50:47 +0000
commit026f3d306d339585612d63a9f6ac5ed8839a3179 (patch)
treeeb4fec18ac74263756c72452098a09e0449a471f
parent28e691995a7d14f3001eede5f00f62b9a64d8a69 (diff)
downloadpdfium-chromium/3018.tar.xz
Libopenjpeg upstream fix for undefined shiftchromium/3019chromium/3018chromium/3017chromium/3016
Patch: https://github.com/uclouvain/openjpeg/commit/20789fed4ec7746e938dd2934a1fb5aa352f4d12 BUG=657440 Change-Id: Ic2320cd4baabbd7bc09ec428c5f49b7ab3e7eb66 Reviewed-on: https://pdfium-review.googlesource.com/2795 Reviewed-by: Tom Sepez <tsepez@chromium.org> Commit-Queue: Nicolás Peña <npm@chromium.org>
-rw-r--r--third_party/libopenjpeg20/0027-undefined-shift-opj_t1_decode_cblk.patch13
-rw-r--r--third_party/libopenjpeg20/README.pdfium1
-rw-r--r--third_party/libopenjpeg20/t1.c2
3 files changed, 15 insertions, 1 deletions
diff --git a/third_party/libopenjpeg20/0027-undefined-shift-opj_t1_decode_cblk.patch b/third_party/libopenjpeg20/0027-undefined-shift-opj_t1_decode_cblk.patch
new file mode 100644
index 0000000000..7ba877ab98
--- /dev/null
+++ b/third_party/libopenjpeg20/0027-undefined-shift-opj_t1_decode_cblk.patch
@@ -0,0 +1,13 @@
+diff --git a/third_party/libopenjpeg20/t1.c b/third_party/libopenjpeg20/t1.c
+index a119db1f7..1ad850c77 100644
+--- a/third_party/libopenjpeg20/t1.c
++++ b/third_party/libopenjpeg20/t1.c
+@@ -1411,7 +1411,7 @@ static OPJ_BOOL opj_t1_decode_cblk(opj_t1_t *t1,
+ }
+ }
+
+- for (passno = 0; passno < seg->real_num_passes; ++passno) {
++ for (passno = 0; (passno < seg->real_num_passes) && (bpno_plus_one >= 1); ++passno) {
+ switch (passtype) {
+ case 0:
+ if (type == T1_TYPE_RAW) {
diff --git a/third_party/libopenjpeg20/README.pdfium b/third_party/libopenjpeg20/README.pdfium
index 8ed63771f7..ea8f5239ba 100644
--- a/third_party/libopenjpeg20/README.pdfium
+++ b/third_party/libopenjpeg20/README.pdfium
@@ -36,4 +36,5 @@ Local Modifications:
0024-l_marker_size_check.patch: Return error before overflow in opj_j2k_read_header_procedure.
0025-opj_j2k_add_mct_null_data.patch: Check m_data != null before trying to read from it.
0026-use_opj_uint_ceildiv.patch: Remove (OPJ_UINT32)opj_int_ceildiv((OPJ_INT32)a, (OPJ_INT32) b).
+0027-undefined-shift-opj_t1_decode_cblk.patch: upstream fix for a ubsan bug.
TODO(thestig): List all the other patches.
diff --git a/third_party/libopenjpeg20/t1.c b/third_party/libopenjpeg20/t1.c
index a119db1f76..1ad850c77e 100644
--- a/third_party/libopenjpeg20/t1.c
+++ b/third_party/libopenjpeg20/t1.c
@@ -1411,7 +1411,7 @@ static OPJ_BOOL opj_t1_decode_cblk(opj_t1_t *t1,
}
}
- for (passno = 0; passno < seg->real_num_passes; ++passno) {
+ for (passno = 0; (passno < seg->real_num_passes) && (bpno_plus_one >= 1); ++passno) {
switch (passtype) {
case 0:
if (type == T1_TYPE_RAW) {