summaryrefslogtreecommitdiff
path: root/core/fxcodec/jbig2/JBig2_Context.cpp
diff options
context:
space:
mode:
authorNicolas Pena <npm@chromium.org>2017-08-30 15:50:09 -0400
committerChromium commit bot <commit-bot@chromium.org>2017-08-30 20:07:56 +0000
commitfd70d79ca67ac87dd95ab23d548b1fcb879ad259 (patch)
treed23251e5d07bef79d613d2a2c93ddc21f07135d2 /core/fxcodec/jbig2/JBig2_Context.cpp
parent674bbfe24ded465a4d27b268ca84f75976d556da (diff)
downloadpdfium-fd70d79ca67ac87dd95ab23d548b1fcb879ad259.tar.xz
Fix undefined shift in CJBig2_Context::decodeSymbolIDHuffmanTable
Bug: chromium:755532 Change-Id: Ib04426fab52d0ca1d2544a21fd2ce4faaa57123f Reviewed-on: https://pdfium-review.googlesource.com/12430 Reviewed-by: Tom Sepez <tsepez@chromium.org> Commit-Queue: Nicolás Peña <npm@chromium.org>
Diffstat (limited to 'core/fxcodec/jbig2/JBig2_Context.cpp')
-rw-r--r--core/fxcodec/jbig2/JBig2_Context.cpp5
1 files changed, 4 insertions, 1 deletions
diff --git a/core/fxcodec/jbig2/JBig2_Context.cpp b/core/fxcodec/jbig2/JBig2_Context.cpp
index eaaed312d6..778db1c591 100644
--- a/core/fxcodec/jbig2/JBig2_Context.cpp
+++ b/core/fxcodec/jbig2/JBig2_Context.cpp
@@ -7,6 +7,7 @@
#include "core/fxcodec/jbig2/JBig2_Context.h"
#include <algorithm>
+#include <limits>
#include <list>
#include <utility>
#include <vector>
@@ -1254,8 +1255,10 @@ std::vector<JBig2HuffmanCode> CJBig2_Context::decodeSymbolIDHuffmanTable(
int32_t nBits = 0;
uint32_t nTemp;
while (true) {
- if (pStream->read1Bit(&nTemp) != 0)
+ if (nVal > std::numeric_limits<int32_t>::max() / 2 ||
+ pStream->read1Bit(&nTemp) != 0) {
return std::vector<JBig2HuffmanCode>();
+ }
nVal = (nVal << 1) | nTemp;
++nBits;