diff options
| author | JUN FANG <jun_fang@foxitsoftware.com> | 2015-03-16 10:56:16 -0700 |
|---|---|---|
| committer | JUN FANG <jun_fang@foxitsoftware.com> | 2015-03-16 11:03:53 -0700 |
| commit | c575365cf5396f3fc53511862fabd89bf066beb8 (patch) | |
| tree | 869e385098e0cc585a4fec671d50ae9d20c5fa7d /core/src | |
| parent | e0557f60dd1a6130c481e3ab4f3787bf1125941a (diff) | |
| download | pdfium-c575365cf5396f3fc53511862fabd89bf066beb8.tar.xz | |
Merge to XFA: Fix potential integer overflow in fpdf_render_image.cpp
BUG=382661
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/1007643002
Diffstat (limited to 'core/src')
| -rw-r--r-- | core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp b/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp index 02da1d93fe..663a74861a 100644 --- a/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp +++ b/core/src/fpdfapi/fpdf_render/fpdf_render_image.cpp @@ -9,6 +9,7 @@ #include "../../../include/fpdfapi/fpdf_module.h" #include "../../../include/fpdfapi/fpdf_render.h" #include "../../../include/fpdfapi/fpdf_pageobj.h" +#include "../../fxcrt/fx_safe_types.h" #include "../fpdf_page/pageint.h" #include "render_int.h" FX_BOOL CPDF_RenderStatus::ProcessImage(CPDF_ImageObject* pImageObj, const CFX_AffineMatrix* pObj2Device) @@ -1007,13 +1008,18 @@ CFX_DIBitmap* CPDF_RenderStatus::LoadSMask(CPDF_Dictionary* pSMaskDict, pCS = m_pContext->m_pDocument->LoadColorSpace(pCSObj); if (pCS) { FX_FLOAT R, G, B; - FX_DWORD num_floats = 8; - if (pCS->CountComponents() > (FX_INT32)num_floats) { - num_floats = (FX_DWORD)pCS->CountComponents(); + FX_DWORD comps = 8; + if (pCS->CountComponents() > static_cast<FX_INT32>(comps)) { + comps = (FX_DWORD)pCS->CountComponents(); } - CFX_FixedBufGrow<FX_FLOAT, 8> float_array(num_floats); + CFX_FixedBufGrow<FX_FLOAT, 8> float_array(comps); FX_FLOAT* pFloats = float_array; - FXSYS_memset32(pFloats, 0, num_floats * sizeof(FX_FLOAT)); + FX_SAFE_DWORD num_floats = comps; + num_floats *= sizeof(FX_FLOAT); + if (!num_floats.IsValid()) { + return NULL; + } + FXSYS_memset32(pFloats, 0, num_floats.ValueOrDie()); int count = pBC->GetCount() > 8 ? 8 : pBC->GetCount(); for (int i = 0; i < count; i ++) { pFloats[i] = pBC->GetNumber(i); |