summaryrefslogtreecommitdiff
path: root/core/src/fxcodec
diff options
context:
space:
mode:
authorBo Xu <bo_xu@foxitsoftware.com>2014-08-27 16:01:41 -0700
committerBo Xu <bo_xu@foxitsoftware.com>2014-08-27 16:01:41 -0700
commitfdcc8744f8f7d807bf0dbc761cdc8d6a6e0798cb (patch)
treed2393aaf980ab24d1093be27dddf4f262c120458 /core/src/fxcodec
parent405478d3870693fbaf8f17758a760abfd276b2ee (diff)
downloadpdfium-fdcc8744f8f7d807bf0dbc761cdc8d6a6e0798cb.tar.xz
Restrict index not be greater than row_size in TIFF_PredictLine
There is not strict way to limit invalid value of |Colors| from dictionary. We can make sure |index| does not go out of boundary of row_size. BUG=407614 R=tsepez@chromium.org Review URL: https://codereview.chromium.org/509993003
Diffstat (limited to 'core/src/fxcodec')
-rw-r--r--core/src/fxcodec/codec/fx_codec_flate.cpp10
1 files changed, 6 insertions, 4 deletions
diff --git a/core/src/fxcodec/codec/fx_codec_flate.cpp b/core/src/fxcodec/codec/fx_codec_flate.cpp
index a12fffbe5c..e17c32a2c7 100644
--- a/core/src/fxcodec/codec/fx_codec_flate.cpp
+++ b/core/src/fxcodec/codec/fx_codec_flate.cpp
@@ -524,17 +524,19 @@ static void TIFF_PredictorEncode(FX_LPBYTE& data_buf, FX_DWORD& data_size,
static void TIFF_PredictLine(FX_LPBYTE dest_buf, int row_size, int BitsPerComponent, int Colors, int Columns)
{
if (BitsPerComponent == 1) {
- int row_bits = BitsPerComponent * Colors * Columns;
+ int row_bits = FX_MIN(BitsPerComponent * Colors * Columns, row_size * 8);
+ int index_pre = 0;
+ int col_pre = 0;
for(int i = 1; i < row_bits; i ++) {
int col = i % 8;
int index = i / 8;
- int index_pre = (col == 0) ? (index - 1) : index;
- int col_pre = (col == 0) ? 8 : col;
- if( ((dest_buf[index] >> (7 - col)) & 1) ^ ((dest_buf[index_pre] >> (8 - col_pre)) & 1) ) {
+ if( ((dest_buf[index] >> (7 - col)) & 1) ^ ((dest_buf[index_pre] >> (7 - col_pre)) & 1) ) {
dest_buf[index] |= 1 << (7 - col);
} else {
dest_buf[index] &= ~(1 << (7 - col));
}
+ index_pre = index;
+ col_pre = col;
}
return;
}