summaryrefslogtreecommitdiff
path: root/core
diff options
context:
space:
mode:
authorOliver Chang <ochang@chromium.org>2015-11-19 19:32:31 -0800
committerOliver Chang <ochang@chromium.org>2015-11-19 19:32:31 -0800
commit06e33aec03f13c76d9eff5c09cb03e142b0c5ef1 (patch)
tree624b77e11f82afd2df5cd9a5ccfba64a872d1c35 /core
parent6fc00fafcbac1fd5edd767fe2d4a8e4a9ef52806 (diff)
downloadpdfium-06e33aec03f13c76d9eff5c09cb03e142b0c5ef1.tar.xz
Add a missing setjmp() to CCodec_JpegDecoder::v_GetNextLine().
If jpeg_read_scanlines() ends up calling the error callback, we longjmp into some undefined state. BUG=558840 R=thestig@chromium.org, tsepez@chromium.org Review URL: https://codereview.chromium.org/1463563003 .
Diffstat (limited to 'core')
-rw-r--r--core/src/fxcodec/codec/fx_codec_jpeg.cpp5
1 files changed, 4 insertions, 1 deletions
diff --git a/core/src/fxcodec/codec/fx_codec_jpeg.cpp b/core/src/fxcodec/codec/fx_codec_jpeg.cpp
index 01481c37ec..89b65cfe3d 100644
--- a/core/src/fxcodec/codec/fx_codec_jpeg.cpp
+++ b/core/src/fxcodec/codec/fx_codec_jpeg.cpp
@@ -480,9 +480,12 @@ FX_BOOL CCodec_JpegDecoder::v_Rewind() {
return TRUE;
}
uint8_t* CCodec_JpegDecoder::v_GetNextLine() {
+ if (setjmp(m_JmpBuf) == -1)
+ return nullptr;
+
int nlines = jpeg_read_scanlines(&cinfo, &m_pScanlineBuf, 1);
if (nlines < 1) {
- return NULL;
+ return nullptr;
}
return m_pScanlineBuf;
}