diff options
| author | Lei Zhang <thestig@chromium.org> | 2018-05-02 14:33:54 +0000 |
|---|---|---|
| committer | Chromium commit bot <commit-bot@chromium.org> | 2018-05-02 14:33:54 +0000 |
| commit | 28cad1534619d55820593baed0b6d6f3cbf767eb (patch) | |
| tree | 365208753d9b2957c5b091165c03c01478bb9436 /core/fxcodec/jbig2/JBig2_Context.cpp | |
| parent | e77cccd4fe7e5b6707370ea7b67e6e303fe2764b (diff) | |
| download | pdfium-28cad1534619d55820593baed0b6d6f3cbf767eb.tar.xz | |
Make several Huffman decoders consistently check for integer overflows.
BUG=chromium:837972
Change-Id: I6cfa28bff38870419e4b1e2bced427cfcbf843cd
Reviewed-on: https://pdfium-review.googlesource.com/31912
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: Ryan Harrison <rharrison@chromium.org>
Diffstat (limited to 'core/fxcodec/jbig2/JBig2_Context.cpp')
| -rw-r--r-- | core/fxcodec/jbig2/JBig2_Context.cpp | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/core/fxcodec/jbig2/JBig2_Context.cpp b/core/fxcodec/jbig2/JBig2_Context.cpp index 1763144b49..b753380aa2 100644 --- a/core/fxcodec/jbig2/JBig2_Context.cpp +++ b/core/fxcodec/jbig2/JBig2_Context.cpp @@ -23,6 +23,7 @@ #include "core/fxcodec/jbig2/JBig2_PddProc.h" #include "core/fxcodec/jbig2/JBig2_SddProc.h" #include "core/fxcodec/jbig2/JBig2_TrdProc.h" +#include "core/fxcrt/fx_safe_types.h" #include "core/fxcrt/pauseindicator_iface.h" #include "third_party/base/ptr_util.h" @@ -1269,17 +1270,20 @@ std::vector<JBig2HuffmanCode> CJBig2_Context::DecodeSymbolIDHuffmanTable( int32_t i = 0; while (i < static_cast<int>(SBNUMSYMS)) { size_t j; - int32_t nVal = 0; + FX_SAFE_INT32 nSafeVal = 0; int32_t nBits = 0; uint32_t nTemp; while (true) { - if (nVal > std::numeric_limits<int32_t>::max() / 2 || - m_pStream->read1Bit(&nTemp) != 0) { + if (m_pStream->read1Bit(&nTemp) != 0) + return std::vector<JBig2HuffmanCode>(); + + nSafeVal <<= 1; + if (!nSafeVal.IsValid()) return std::vector<JBig2HuffmanCode>(); - } - nVal = (nVal << 1) | nTemp; + nSafeVal |= nTemp; ++nBits; + const int32_t nVal = nSafeVal.ValueOrDie(); for (j = 0; j < kRunCodesSize; ++j) { if (nBits == huffman_codes[j].codelen && nVal == huffman_codes[j].code) break; |