summaryrefslogtreecommitdiff
path: root/core/fxcodec/jbig2
diff options
context:
space:
mode:
authorNicolas Pena <npm@chromium.org>2017-11-08 17:39:12 +0000
committerChromium commit bot <commit-bot@chromium.org>2017-11-08 17:39:12 +0000
commit7055dffad92bd7be7cdb20ed12d5cc5890177e7a (patch)
treee12e7bb8caa56d9a6dc00f40f471ade6d68fbac0 /core/fxcodec/jbig2
parent269ef77ccbb20db68c0b5049bb6a3a867623db64 (diff)
downloadpdfium-7055dffad92bd7be7cdb20ed12d5cc5890177e7a.tar.xz
Prevent cyclic offset on CJBig2_Context
This CL changes the type of |m_dwOffset| to safe unsigned integer to prevent the offset from cycling from MAX_UINT32 back to 0. Bug: chromium:778912 Change-Id: Ib93a8392e52eecf2cc223438ac85e9dc529b0f43 Reviewed-on: https://pdfium-review.googlesource.com/18130 Reviewed-by: Tom Sepez <tsepez@chromium.org> Commit-Queue: Nicolás Peña Moreno <npm@chromium.org>
Diffstat (limited to 'core/fxcodec/jbig2')
-rw-r--r--core/fxcodec/jbig2/JBig2_Context.cpp5
-rw-r--r--core/fxcodec/jbig2/JBig2_Context.h3
2 files changed, 6 insertions, 2 deletions
diff --git a/core/fxcodec/jbig2/JBig2_Context.cpp b/core/fxcodec/jbig2/JBig2_Context.cpp
index 53e6b7a84a..6985c0e927 100644
--- a/core/fxcodec/jbig2/JBig2_Context.cpp
+++ b/core/fxcodec/jbig2/JBig2_Context.cpp
@@ -101,7 +101,10 @@ int32_t CJBig2_Context::decode_SquentialOrgnazation(
}
if (m_pSegment->m_dwData_length != 0xffffffff) {
m_dwOffset += m_pSegment->m_dwData_length;
- m_pStream->setOffset(m_dwOffset);
+ if (!m_dwOffset.IsValid())
+ return JBIG2_ERROR_FATAL;
+
+ m_pStream->setOffset(m_dwOffset.ValueOrDie());
} else {
m_pStream->offset(4);
}
diff --git a/core/fxcodec/jbig2/JBig2_Context.h b/core/fxcodec/jbig2/JBig2_Context.h
index 314db9083a..749ec901f4 100644
--- a/core/fxcodec/jbig2/JBig2_Context.h
+++ b/core/fxcodec/jbig2/JBig2_Context.h
@@ -16,6 +16,7 @@
#include "core/fxcodec/fx_codec_def.h"
#include "core/fxcodec/jbig2/JBig2_Page.h"
#include "core/fxcodec/jbig2/JBig2_Segment.h"
+#include "core/fxcrt/fx_safe_types.h"
class CJBig2_ArithDecoder;
class CJBig2_GRDProc;
@@ -101,7 +102,7 @@ class CJBig2_Context {
std::unique_ptr<CJBig2_ArithDecoder> m_pArithDecoder;
std::unique_ptr<CJBig2_GRDProc> m_pGRD;
std::unique_ptr<CJBig2_Segment> m_pSegment;
- uint32_t m_dwOffset;
+ FX_SAFE_UINT32 m_dwOffset;
JBig2RegionInfo m_ri;
std::list<CJBig2_CachePair>* const m_pSymbolDictCache;
bool m_bIsGlobal;