summaryrefslogtreecommitdiff
path: root/core/fxcodec
diff options
context:
space:
mode:
authornpm <npm@chromium.org>2016-11-22 13:15:20 -0800
committerCommit bot <commit-bot@chromium.org>2016-11-22 13:15:20 -0800
commit5048731cf0b1221a81e76d7f6e95f24159bb87e2 (patch)
tree687e3f944a45f906db586d6a2e261a39ad5e9246 /core/fxcodec
parentc675a2f4afdd7e54bc4b4638bd1ffcb2de0b7124 (diff)
downloadpdfium-5048731cf0b1221a81e76d7f6e95f24159bb87e2.tar.xz
Multiply safely in CCodec_TiffContext::Decode
BUG=667074 Review-Url: https://codereview.chromium.org/2520253003
Diffstat (limited to 'core/fxcodec')
-rw-r--r--core/fxcodec/codec/fx_codec_tiff.cpp6
1 files changed, 5 insertions, 1 deletions
diff --git a/core/fxcodec/codec/fx_codec_tiff.cpp b/core/fxcodec/codec/fx_codec_tiff.cpp
index c4c745587f..8046f1cc39 100644
--- a/core/fxcodec/codec/fx_codec_tiff.cpp
+++ b/core/fxcodec/codec/fx_codec_tiff.cpp
@@ -447,7 +447,11 @@ bool CCodec_TiffContext::Decode(CFX_DIBitmap* pDIBitmap) {
uint16_t bps = 0;
TIFFGetField(m_tif_ctx, TIFFTAG_SAMPLESPERPIXEL, &spp);
TIFFGetField(m_tif_ctx, TIFFTAG_BITSPERSAMPLE, &bps);
- uint32_t bpp = bps * spp;
+ FX_SAFE_UINT32 safe_bpp = bps;
+ safe_bpp *= spp;
+ if (!safe_bpp.IsValid())
+ return false;
+ uint32_t bpp = safe_bpp.ValueOrDie();
if (bpp == 1)
return Decode1bppRGB(pDIBitmap, height, width, bps, spp);
if (bpp <= 8)