summaryrefslogtreecommitdiff
path: root/core
diff options
context:
space:
mode:
authorLei Zhang <thestig@chromium.org>2015-10-02 10:58:42 -0700
committerLei Zhang <thestig@chromium.org>2015-10-02 10:58:42 -0700
commit9fb70fbded5c0bf4f5313a49fd3496b4d4fa71ca (patch)
treea6191222ec55bd8625f36b5942fc538f80c98349 /core
parent63d0a52a6af7d327fdb5792f520cc8d93fe2f1bb (diff)
downloadpdfium-9fb70fbded5c0bf4f5313a49fd3496b4d4fa71ca.tar.xz
Prevent divide by zeros in CJBig2_GSIDProc::decode_MMR().
Check the image size before attempting to decode. BUG=538103 R=tsepez@chromium.org Review URL: https://codereview.chromium.org/1377493005 .
Diffstat (limited to 'core')
-rw-r--r--core/src/fxcodec/jbig2/JBig2_Context.cpp5
1 files changed, 5 insertions, 0 deletions
diff --git a/core/src/fxcodec/jbig2/JBig2_Context.cpp b/core/src/fxcodec/jbig2/JBig2_Context.cpp
index 2e2cf9eeee..f2c44b726a 100644
--- a/core/src/fxcodec/jbig2/JBig2_Context.cpp
+++ b/core/src/fxcodec/jbig2/JBig2_Context.cpp
@@ -1127,6 +1127,11 @@ int32_t CJBig2_Context::parseHalftoneRegion(CJBig2_Segment* pSegment,
nRet = JBIG2_ERROR_TOO_SHORT;
goto failed;
}
+ if (pHRD->HGW == 0 || pHRD->HGH == 0) {
+ nRet = JBIG2_ERROR_FATAL;
+ goto failed;
+ }
+
pHRD->HBW = ri.width;
pHRD->HBH = ri.height;
pHRD->HMMR = cFlags & 0x01;