diff options
| author | Oliver Chang <ochang@chromium.org> | 2015-11-20 10:01:48 -0800 |
|---|---|---|
| committer | Oliver Chang <ochang@chromium.org> | 2015-11-20 10:01:48 -0800 |
| commit | 0afbad0509578a5fee6fec4394d6b3c55425cf28 (patch) | |
| tree | 2257aa12c0d9103ab9b1d83fb573dace3f5e218a /core/src/fxcodec/codec/fx_codec_jpeg.cpp | |
| parent | c7e4c4fe17f5c05671183a47541ea17f3dce75b5 (diff) | |
| download | pdfium-0afbad0509578a5fee6fec4394d6b3c55425cf28.tar.xz | |
Merge to XFA: Change |CCodec_ScanlineDecoder::m_Pitch| to FX_DWORD
This matches the type of the corresponding |CFX_DIBSource::m_Pitch|,
where integer overflow is checked for FX_DWORD. This change is
propagated to many other places.
Also, check for integer overflow in |CCodec_RLScanlineDecoder::Create|
during the calculation of |m_Pitch| since it aligns to 4 bytes while
overflow was was previously checked without this alignment.
TBR=tsepez@chromium.org
BUG=555784
Review URL: https://codereview.chromium.org/1460033002 .
(cherry picked from commit e7950df70a2fd658f466751b29483436cb31e829)
Review URL: https://codereview.chromium.org/1461363002 .
Diffstat (limited to 'core/src/fxcodec/codec/fx_codec_jpeg.cpp')
| -rw-r--r-- | core/src/fxcodec/codec/fx_codec_jpeg.cpp | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/core/src/fxcodec/codec/fx_codec_jpeg.cpp b/core/src/fxcodec/codec/fx_codec_jpeg.cpp index c06253d785..b59deb5a0d 100644 --- a/core/src/fxcodec/codec/fx_codec_jpeg.cpp +++ b/core/src/fxcodec/codec/fx_codec_jpeg.cpp @@ -427,7 +427,9 @@ FX_BOOL CCodec_JpegDecoder::Create(const uint8_t* src_buf, if ((int)cinfo.image_width < width) { return FALSE; } - m_Pitch = (cinfo.image_width * cinfo.num_components + 3) / 4 * 4; + m_Pitch = + (static_cast<FX_DWORD>(cinfo.image_width) * cinfo.num_components + 3) / + 4 * 4; m_pScanlineBuf = FX_Alloc(uint8_t, m_Pitch); m_nComps = cinfo.num_components; m_bpc = 8; @@ -461,7 +463,7 @@ void CCodec_JpegDecoder::v_DownScale(int dest_width, int dest_height) { FX_GetDownsampleRatio(m_OrigWidth, m_OrigHeight, dest_width, dest_height); m_OutputWidth = (m_OrigWidth + m_DownScale - 1) / m_DownScale; m_OutputHeight = (m_OrigHeight + m_DownScale - 1) / m_DownScale; - m_Pitch = (m_OutputWidth * m_nComps + 3) / 4 * 4; + m_Pitch = (static_cast<FX_DWORD>(m_OutputWidth) * m_nComps + 3) / 4 * 4; if (old_scale != m_DownScale) { m_NextLine = -1; } |