summaryrefslogtreecommitdiff
path: root/core/fpdfapi/fpdf_parser
diff options
context:
space:
mode:
authorthestig <thestig@chromium.org>2016-08-23 18:11:30 -0700
committerCommit bot <commit-bot@chromium.org>2016-08-23 18:11:30 -0700
commit8252bc1e5a42ab406fb5f9f968623ea0c83b8656 (patch)
treef75fa8a136e9bb076f711d1ae280ecfcbcd7d84a /core/fpdfapi/fpdf_parser
parent837735660808d52580703183ae24a3c7c7b05c7d (diff)
downloadpdfium-8252bc1e5a42ab406fb5f9f968623ea0c83b8656.tar.xz
Fix one more integer overflow in ReadPageHintTable().
BUG=637119 Review-Url: https://codereview.chromium.org/2274723002
Diffstat (limited to 'core/fpdfapi/fpdf_parser')
-rw-r--r--core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp2
1 files changed, 1 insertions, 1 deletions
diff --git a/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp b/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
index 18a7b8f079..4363d3924c 100644
--- a/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
+++ b/core/fpdfapi/fpdf_parser/cpdf_hint_tables.cpp
@@ -122,7 +122,7 @@ bool CPDF_HintTables::ReadPageHintTable(CFX_BitStream* hStream) {
// than enough to represent most of the values here.
constexpr uint32_t kMaxBits = 34;
if (dwSharedObjBits > kMaxBits || dwDeltaObjectsBits > kMaxBits ||
- dwSharedIdBits > kMaxBits) {
+ dwDeltaPageLenBits > kMaxBits || dwSharedIdBits > kMaxBits) {
return false;
}