summaryrefslogtreecommitdiff
path: root/core/fpdfapi
diff options
context:
space:
mode:
authordsinclair <dsinclair@chromium.org>2016-09-07 13:54:01 -0700
committerCommit bot <commit-bot@chromium.org>2016-09-07 13:54:01 -0700
commitf56d93f8ea1c2145401e99e61cefdbfcb7341229 (patch)
tree6d80ab38999c716870132a9bbe5874fd879465a9 /core/fpdfapi
parentb1f5545e34375a5947004ee92cc808b3df9d4a5b (diff)
downloadpdfium-f56d93f8ea1c2145401e99e61cefdbfcb7341229.tar.xz
Verify image dimentions before using
Verify the provided image size is within bounds before loading. BUG=chromium:639160 Review-Url: https://codereview.chromium.org/2323473002
Diffstat (limited to 'core/fpdfapi')
-rw-r--r--core/fpdfapi/fpdf_render/fpdf_render_image.cpp3
1 files changed, 3 insertions, 0 deletions
diff --git a/core/fpdfapi/fpdf_render/fpdf_render_image.cpp b/core/fpdfapi/fpdf_render/fpdf_render_image.cpp
index e7e9682322..e23cab3546 100644
--- a/core/fpdfapi/fpdf_render/fpdf_render_image.cpp
+++ b/core/fpdfapi/fpdf_render/fpdf_render_image.cpp
@@ -366,6 +366,9 @@ CPDF_ImageRenderer::~CPDF_ImageRenderer() {
FX_BOOL CPDF_ImageRenderer::StartLoadDIBSource() {
CFX_FloatRect image_rect_f = m_ImageMatrix.GetUnitRect();
FX_RECT image_rect = image_rect_f.GetOuterRect();
+ if (!image_rect.Valid())
+ return FALSE;
+
int dest_width = image_rect.Width();
int dest_height = image_rect.Height();
if (m_ImageMatrix.a < 0) {