summaryrefslogtreecommitdiff
path: root/core/fxge
diff options
context:
space:
mode:
authorRyan Harrison <rharrison@chromium.org>2017-07-07 14:03:55 -0400
committerChromium commit bot <commit-bot@chromium.org>2017-07-07 18:22:36 +0000
commitf6f68c75ce54a5865fb19dcb075e7734f1639663 (patch)
treee14853071407d92fbb820fda7725a51d77afedfe /core/fxge
parentc3d3bb2a036bc26ad1b3c7c5f03ce11f41529b33 (diff)
downloadpdfium-f6f68c75ce54a5865fb19dcb075e7734f1639663.tar.xz
Check that there is enough data remaining in source BMP before readingchromium/3152
When reading in a BMP, after processing the header, make sure that there is enough data remaining in the source before proceeding. If not signal that the BMP is improperly formatted. BUG=chromium:738635 Change-Id: I506bc0e6db7dcd4b5984fd91a1f39516320a2037 Reviewed-on: https://pdfium-review.googlesource.com/7280 Reviewed-by: Tom Sepez <tsepez@chromium.org> Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Diffstat (limited to 'core/fxge')
-rw-r--r--core/fxge/dib/cfx_dibitmap.cpp53
-rw-r--r--core/fxge/dib/cfx_dibitmap.h8
2 files changed, 42 insertions, 19 deletions
diff --git a/core/fxge/dib/cfx_dibitmap.cpp b/core/fxge/dib/cfx_dibitmap.cpp
index 48cbc3291c..43b0da0edf 100644
--- a/core/fxge/dib/cfx_dibitmap.cpp
+++ b/core/fxge/dib/cfx_dibitmap.cpp
@@ -34,36 +34,32 @@ bool CFX_DIBitmap::Create(int width,
int height,
FXDIB_Format format,
uint8_t* pBuffer,
- int pitch) {
+ uint32_t pitch) {
m_pBuffer = nullptr;
m_bpp = static_cast<uint8_t>(format);
m_AlphaFlag = static_cast<uint8_t>(format >> 8);
- m_Width = m_Height = m_Pitch = 0;
- if (width <= 0 || height <= 0 || pitch < 0)
- return false;
-
- if ((INT_MAX - 31) / width < (format & 0xff))
- return false;
-
- if (!pitch)
- pitch = (width * (format & 0xff) + 31) / 32 * 4;
+ m_Width = 0;
+ m_Height = 0;
+ m_Pitch = 0;
- if ((1 << 30) / pitch < height)
+ uint32_t calculatedSize;
+ if (!CFX_DIBitmap::CalculatePitchAndSize(height, width, format, &pitch,
+ &calculatedSize))
return false;
if (pBuffer) {
m_pBuffer.Reset(pBuffer);
} else {
- int size = pitch * height + 4;
- int oomlimit = MAX_OOM_LIMIT;
- if (oomlimit >= 0 && size >= oomlimit) {
- m_pBuffer =
- std::unique_ptr<uint8_t, FxFreeDeleter>(FX_TryAlloc(uint8_t, size));
+ size_t bufferSize = calculatedSize + 4;
+ size_t oomlimit = MAX_OOM_LIMIT;
+ if (bufferSize >= oomlimit) {
+ m_pBuffer = std::unique_ptr<uint8_t, FxFreeDeleter>(
+ FX_TryAlloc(uint8_t, bufferSize));
if (!m_pBuffer)
return false;
} else {
- m_pBuffer =
- std::unique_ptr<uint8_t, FxFreeDeleter>(FX_Alloc(uint8_t, size));
+ m_pBuffer = std::unique_ptr<uint8_t, FxFreeDeleter>(
+ FX_Alloc(uint8_t, bufferSize));
}
}
m_Width = width;
@@ -816,6 +812,27 @@ bool CFX_DIBitmap::ConvertColorScale(uint32_t forecolor, uint32_t backcolor) {
return true;
}
+bool CFX_DIBitmap::CalculatePitchAndSize(int height,
+ int width,
+ FXDIB_Format format,
+ uint32_t* pitch,
+ uint32_t* size) {
+ if (width <= 0 || height <= 0)
+ return false;
+
+ if ((INT_MAX - 31) / width < (format & 0xFF))
+ return false;
+
+ if (!*pitch)
+ *pitch = static_cast<uint32_t>((width * (format & 0xff) + 31) / 32 * 4);
+
+ if ((1 << 30) / *pitch < static_cast<uint32_t>(height))
+ return false;
+
+ *size = *pitch * static_cast<uint32_t>(height);
+ return true;
+}
+
bool CFX_DIBitmap::CompositeBitmap(
int dest_left,
int dest_top,
diff --git a/core/fxge/dib/cfx_dibitmap.h b/core/fxge/dib/cfx_dibitmap.h
index df751db3df..2b5555befc 100644
--- a/core/fxge/dib/cfx_dibitmap.h
+++ b/core/fxge/dib/cfx_dibitmap.h
@@ -25,7 +25,7 @@ class CFX_DIBitmap : public CFX_DIBSource {
int height,
FXDIB_Format format,
uint8_t* pBuffer = nullptr,
- int pitch = 0);
+ uint32_t pitch = 0);
bool Copy(const CFX_RetainPtr<CFX_DIBSource>& pSrc);
@@ -96,6 +96,12 @@ class CFX_DIBitmap : public CFX_DIBSource {
bool ConvertColorScale(uint32_t forecolor, uint32_t backcolor);
+ static bool CalculatePitchAndSize(int height,
+ int width,
+ FXDIB_Format format,
+ uint32_t* pitch,
+ uint32_t* size);
+
#if defined _SKIA_SUPPORT_ || _SKIA_SUPPORT_PATHS_
void PreMultiply();
#endif