diff options
| author | Lei Zhang <thestig@chromium.org> | 2017-03-01 00:32:20 -0800 |
|---|---|---|
| committer | Chromium commit bot <commit-bot@chromium.org> | 2017-03-01 16:45:36 +0000 |
| commit | ef81390393ef5fed1ba168cff081d459eed9f260 (patch) | |
| tree | 89dcc109865b846a95a3f6e121d900e9a03b240d /core/fpdfapi/page/cpdf_streamcontentparser.cpp | |
| parent | e13ad88925bde037f4ed3b60f9ea5f01b883aa6e (diff) | |
| download | pdfium-ef81390393ef5fed1ba168cff081d459eed9f260.tar.xz | |
Fix infinite loops in CPDF_MeshStream.
BUG=chromium:690501
Change-Id: I74b09d90a8082554a67f737eb6adc3bff82ed93e
Reviewed-on: https://pdfium-review.googlesource.com/2889
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
Diffstat (limited to 'core/fpdfapi/page/cpdf_streamcontentparser.cpp')
| -rw-r--r-- | core/fpdfapi/page/cpdf_streamcontentparser.cpp | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/core/fpdfapi/page/cpdf_streamcontentparser.cpp b/core/fpdfapi/page/cpdf_streamcontentparser.cpp index d8e1c1e15d..6211b6a4dd 100644 --- a/core/fpdfapi/page/cpdf_streamcontentparser.cpp +++ b/core/fpdfapi/page/cpdf_streamcontentparser.cpp @@ -98,8 +98,11 @@ CFX_FloatRect GetShadingBBox(CPDF_ShadingPattern* pShading, while (!stream.BitStream()->IsEOF()) { uint32_t flag = 0; - if (type != kLatticeFormGouraudTriangleMeshShading) + if (type != kLatticeFormGouraudTriangleMeshShading) { + if (!stream.CanReadFlag()) + break; flag = stream.ReadFlag(); + } if (!bGouraud && flag) { point_count -= 4; @@ -107,6 +110,8 @@ CFX_FloatRect GetShadingBBox(CPDF_ShadingPattern* pShading, } for (int i = 0; i < point_count; i++) { + if (!stream.CanReadCoords()) + break; CFX_PointF origin = stream.ReadCoords(); if (bStarted) { rect.UpdateRect(origin.x, origin.y); |