summaryrefslogtreecommitdiff
path: root/core/src
diff options
context:
space:
mode:
authorBo Xu <bo_xu@foxitsoftware.com>2014-08-15 12:24:45 -0700
committerBo Xu <bo_xu@foxitsoftware.com>2014-08-15 12:24:45 -0700
commitd726307fa4384f8dcb23a6498dde5a78436322ec (patch)
tree58493118803f3475281900587f5dd6fba8b119aa /core/src
parent368ed462dd6e5e63977ca2b2e56a7e83b3a3bdda (diff)
downloadpdfium-d726307fa4384f8dcb23a6498dde5a78436322ec.tar.xz
Fix buffer size offset error in PNG_Predictor
BUG=393602 R=tsepez@chromium.org Review URL: https://codereview.chromium.org/466153005
Diffstat (limited to 'core/src')
-rw-r--r--core/src/fxcodec/codec/fx_codec_flate.cpp4
1 files changed, 2 insertions, 2 deletions
diff --git a/core/src/fxcodec/codec/fx_codec_flate.cpp b/core/src/fxcodec/codec/fx_codec_flate.cpp
index c02f0977cf..a12fffbe5c 100644
--- a/core/src/fxcodec/codec/fx_codec_flate.cpp
+++ b/core/src/fxcodec/codec/fx_codec_flate.cpp
@@ -398,6 +398,7 @@ static void PNG_Predictor(FX_LPBYTE& data_buf, FX_DWORD& data_size,
FX_LPBYTE pDestData = dest_buf;
for (int row = 0; row < row_count; row ++) {
FX_BYTE tag = pSrcData[0];
+ byte_cnt++;
if (tag == 0) {
int move_size = row_size;
if ((row + 1) * (move_size + 1) > (int)data_size) {
@@ -406,7 +407,7 @@ static void PNG_Predictor(FX_LPBYTE& data_buf, FX_DWORD& data_size,
FXSYS_memmove32(pDestData, pSrcData + 1, move_size);
pSrcData += move_size + 1;
pDestData += move_size;
- byte_cnt += move_size + 1;
+ byte_cnt += move_size;
continue;
}
for (int byte = 0; byte < row_size && byte_cnt < (int)data_size; byte ++) {
@@ -464,7 +465,6 @@ static void PNG_Predictor(FX_LPBYTE& data_buf, FX_DWORD& data_size,
}
pSrcData += row_size + 1;
pDestData += row_size;
- byte_cnt++;
}
FX_Free(data_buf);
data_buf = dest_buf;