summaryrefslogtreecommitdiff
path: root/core/fpdfapi/page/cpdf_expintfunc.cpp
diff options
context:
space:
mode:
authorLei Zhang <thestig@chromium.org>2018-04-19 16:53:32 +0000
committerChromium commit bot <commit-bot@chromium.org>2018-04-19 16:53:32 +0000
commit93358c23262e27ead528ac60607329ba0ea0a49a (patch)
tree352c9aec26cb5d1bc18ef77debedce3328cbaed9 /core/fpdfapi/page/cpdf_expintfunc.cpp
parent54e6da1ee793f436341dfcdc4e0c26b0658d1928 (diff)
downloadpdfium-93358c23262e27ead528ac60607329ba0ea0a49a.tar.xz
Do a bit more validation in CPDF_ExpIntFunc::v_Init().
Also do some cleanup and use FX_SAFE_UINT32. Change-Id: I8e9fc49fb768cfc4b13b164c1dcf51b8ca99ec0b Reviewed-on: https://pdfium-review.googlesource.com/30934 Commit-Queue: Lei Zhang <thestig@chromium.org> Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
Diffstat (limited to 'core/fpdfapi/page/cpdf_expintfunc.cpp')
-rw-r--r--core/fpdfapi/page/cpdf_expintfunc.cpp33
1 files changed, 20 insertions, 13 deletions
diff --git a/core/fpdfapi/page/cpdf_expintfunc.cpp b/core/fpdfapi/page/cpdf_expintfunc.cpp
index 020fe1fb81..0b3dc24033 100644
--- a/core/fpdfapi/page/cpdf_expintfunc.cpp
+++ b/core/fpdfapi/page/cpdf_expintfunc.cpp
@@ -8,12 +8,11 @@
#include "core/fpdfapi/parser/cpdf_array.h"
#include "core/fpdfapi/parser/cpdf_dictionary.h"
+#include "core/fpdfapi/parser/cpdf_number.h"
#include "core/fxcrt/fx_memory.h"
CPDF_ExpIntFunc::CPDF_ExpIntFunc()
- : CPDF_Function(Type::kType2ExpotentialInterpolation),
- m_pBeginValues(nullptr),
- m_pEndValues(nullptr) {}
+ : CPDF_Function(Type::kType2ExpotentialInterpolation) {}
CPDF_ExpIntFunc::~CPDF_ExpIntFunc() {
FX_Free(m_pBeginValues);
@@ -26,14 +25,21 @@ bool CPDF_ExpIntFunc::v_Init(CPDF_Object* pObj,
if (!pDict)
return false;
- CPDF_Array* pArray0 = pDict->GetArrayFor("C0");
- if (m_nOutputs == 0) {
- m_nOutputs = 1;
- if (pArray0)
- m_nOutputs = pArray0->GetCount();
+ {
+ CPDF_Number* pExponent = ToNumber(pDict->GetObjectFor("N"));
+ if (!pExponent)
+ return false;
+
+ m_Exponent = pExponent->GetNumber();
}
- CPDF_Array* pArray1 = pDict->GetArrayFor("C1");
+ const CPDF_Array* pArray0 = pDict->GetArrayFor("C0");
+ if (pArray0 && m_nOutputs == 0)
+ m_nOutputs = pArray0->GetCount();
+ if (m_nOutputs == 0)
+ m_nOutputs = 1;
+
+ const CPDF_Array* pArray1 = pDict->GetArrayFor("C1");
m_pBeginValues = FX_Alloc2D(float, m_nOutputs, 2);
m_pEndValues = FX_Alloc2D(float, m_nOutputs, 2);
for (uint32_t i = 0; i < m_nOutputs; i++) {
@@ -41,12 +47,13 @@ bool CPDF_ExpIntFunc::v_Init(CPDF_Object* pObj,
m_pEndValues[i] = pArray1 ? pArray1->GetFloatAt(i) : 1.0f;
}
- m_Exponent = pDict->GetFloatFor("N");
- m_nOrigOutputs = m_nOutputs;
- if (m_nOutputs && m_nInputs > INT_MAX / m_nOutputs)
+ FX_SAFE_UINT32 nOutputs = m_nOutputs;
+ nOutputs *= m_nInputs;
+ if (!nOutputs.IsValid())
return false;
- m_nOutputs *= m_nInputs;
+ m_nOrigOutputs = m_nOutputs;
+ m_nOutputs = nOutputs.ValueOrDie();
return true;
}