summaryrefslogtreecommitdiff
path: root/core/fxcodec
diff options
context:
space:
mode:
authordsinclair <dsinclair@chromium.org>2016-09-12 14:04:08 -0700
committerCommit bot <commit-bot@chromium.org>2016-09-12 14:04:08 -0700
commitdb319ec6a9330e75276b873f6027caddf2a15ec0 (patch)
tree846a18c97bdd9f2649c7bc868ab37cde591ec3d4 /core/fxcodec
parent01b67ed9b441cd485997bc08482def1f2ab265db (diff)
downloadpdfium-db319ec6a9330e75276b873f6027caddf2a15ec0.tar.xz
Verify value of prec before using
The fx_codec_jpx_opj code will attempt to do a 1 << (prec - 1). If the prec value is >=32 then that shift will overflow the int value. This CL adds a check that prec is < 32 before attempting the shift. BUG=chromium:633208 Review-Url: https://codereview.chromium.org/2334823002
Diffstat (limited to 'core/fxcodec')
-rw-r--r--core/fxcodec/codec/fx_codec_jpx_opj.cpp3
1 files changed, 3 insertions, 0 deletions
diff --git a/core/fxcodec/codec/fx_codec_jpx_opj.cpp b/core/fxcodec/codec/fx_codec_jpx_opj.cpp
index ed9331974d..a1c38d06e9 100644
--- a/core/fxcodec/codec/fx_codec_jpx_opj.cpp
+++ b/core/fxcodec/codec/fx_codec_jpx_opj.cpp
@@ -231,6 +231,9 @@ static void sycc422_to_rgb(opj_image_t* img) {
return;
int prec = img->comps[0].prec;
+ if (prec <= 0 || prec >= 32)
+ return;
+
int offset = 1 << (prec - 1);
int upb = (1 << prec) - 1;