summaryrefslogtreecommitdiff
path: root/core/src/fpdfapi
diff options
context:
space:
mode:
authorJUN FANG <jun_fang@foxitsoftware.com>2015-03-16 10:56:16 -0700
committerJUN FANG <jun_fang@foxitsoftware.com>2015-03-16 10:56:16 -0700
commitae5b85a6d5ca1f3c3abd988f19ddc8bfd904464a (patch)
treeeddf7307a8bddd40ac65422e2e8275e6c9147449 /core/src/fpdfapi
parentb8cd18a4ab6d408f061ba3255a46882dbbf071f8 (diff)
downloadpdfium-ae5b85a6d5ca1f3c3abd988f19ddc8bfd904464a.tar.xz
Fix potential integer overflow in fpdf_render_image.cpp
BUG=382661 R=tsepez@chromium.org Review URL: https://codereview.chromium.org/1007643002
Diffstat (limited to 'core/src/fpdfapi')
-rw-r--r--core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp16
1 files changed, 11 insertions, 5 deletions
diff --git a/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp b/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp
index 02da1d93fe..663a74861a 100644
--- a/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp
+++ b/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp
@@ -9,6 +9,7 @@
#include "../../../include/fpdfapi/fpdf_module.h"
#include "../../../include/fpdfapi/fpdf_render.h"
#include "../../../include/fpdfapi/fpdf_pageobj.h"
+#include "../../fxcrt/fx_safe_types.h"
#include "../fpdf_page/pageint.h"
#include "render_int.h"
FX_BOOL CPDF_RenderStatus::ProcessImage(CPDF_ImageObject* pImageObj, const CFX_AffineMatrix* pObj2Device)
@@ -1007,13 +1008,18 @@ CFX_DIBitmap* CPDF_RenderStatus::LoadSMask(CPDF_Dictionary* pSMaskDict,
pCS = m_pContext->m_pDocument->LoadColorSpace(pCSObj);
if (pCS) {
FX_FLOAT R, G, B;
- FX_DWORD num_floats = 8;
- if (pCS->CountComponents() > (FX_INT32)num_floats) {
- num_floats = (FX_DWORD)pCS->CountComponents();
+ FX_DWORD comps = 8;
+ if (pCS->CountComponents() > static_cast<FX_INT32>(comps)) {
+ comps = (FX_DWORD)pCS->CountComponents();
}
- CFX_FixedBufGrow<FX_FLOAT, 8> float_array(num_floats);
+ CFX_FixedBufGrow<FX_FLOAT, 8> float_array(comps);
FX_FLOAT* pFloats = float_array;
- FXSYS_memset32(pFloats, 0, num_floats * sizeof(FX_FLOAT));
+ FX_SAFE_DWORD num_floats = comps;
+ num_floats *= sizeof(FX_FLOAT);
+ if (!num_floats.IsValid()) {
+ return NULL;
+ }
+ FXSYS_memset32(pFloats, 0, num_floats.ValueOrDie());
int count = pBC->GetCount() > 8 ? 8 : pBC->GetCount();
for (int i = 0; i < count; i ++) {
pFloats[i] = pBC->GetNumber(i);