summaryrefslogtreecommitdiff
path: root/core
diff options
context:
space:
mode:
authorJUN FANG <jun_fang@foxitsoftware.com>2015-04-13 10:34:10 -0700
committerJUN FANG <jun_fang@foxitsoftware.com>2015-04-13 10:44:51 -0700
commit63de95b699a4374982c2ddffced89e0da028fe4c (patch)
tree227c497f0f9200c0d1baffc760705c6653f3c248 /core
parentc0c944cb1adadede295af97fb272feb7050d9c0a (diff)
downloadpdfium-63de95b699a4374982c2ddffced89e0da028fe4c.tar.xz
Merge to XFA: Fix a heap overflow in CJBig2_Context::parseSymbolDict
BUG=476107 R=tsepez@chromium.org Review URL: https://codereview.chromium.org/1080893002
Diffstat (limited to 'core')
-rw-r--r--core/src/fxcodec/jbig2/JBig2_ArithDecoder.h4
-rw-r--r--core/src/fxcodec/jbig2/JBig2_ArithQe.h1
-rw-r--r--core/src/fxcodec/jbig2/JBig2_GeneralDecoder.cpp2
3 files changed, 7 insertions, 0 deletions
diff --git a/core/src/fxcodec/jbig2/JBig2_ArithDecoder.h b/core/src/fxcodec/jbig2/JBig2_ArithDecoder.h
index 214688d3b2..33bbe39d0d 100644
--- a/core/src/fxcodec/jbig2/JBig2_ArithDecoder.h
+++ b/core/src/fxcodec/jbig2/JBig2_ArithDecoder.h
@@ -72,6 +72,10 @@ inline void CJBig2_ArithDecoder::BYTEIN()
}
inline int CJBig2_ArithDecoder::DECODE(JBig2ArithCtx *pCX)
{
+ if (!pCX || pCX->I >= JBIG2_QE_NUM) {
+ return 0;
+ }
+
int D;
const JBig2ArithQe * qe = &QeTable[pCX->I];
A = A - qe->Qe;
diff --git a/core/src/fxcodec/jbig2/JBig2_ArithQe.h b/core/src/fxcodec/jbig2/JBig2_ArithQe.h
index 5405e425b0..8a723bead0 100644
--- a/core/src/fxcodec/jbig2/JBig2_ArithQe.h
+++ b/core/src/fxcodec/jbig2/JBig2_ArithQe.h
@@ -13,4 +13,5 @@ typedef struct {
unsigned int nSwitch;
} JBig2ArithQe;
extern const JBig2ArithQe QeTable[];
+extern const unsigned int JBIG2_QE_NUM;
#endif
diff --git a/core/src/fxcodec/jbig2/JBig2_GeneralDecoder.cpp b/core/src/fxcodec/jbig2/JBig2_GeneralDecoder.cpp
index 6179317890..53faab4a46 100644
--- a/core/src/fxcodec/jbig2/JBig2_GeneralDecoder.cpp
+++ b/core/src/fxcodec/jbig2/JBig2_GeneralDecoder.cpp
@@ -61,6 +61,8 @@ extern const JBig2ArithQe QeTable[] = {
{ 0x5601, 46, 46, 0 }
};
+extern const unsigned int JBIG2_QE_NUM = sizeof(QeTable) / sizeof(JBig2ArithQe);
+
CJBig2_Image *CJBig2_GRDProc::decode_Arith(CJBig2_ArithDecoder *pArithDecoder, JBig2ArithCtx *gbContext)
{
if (GBW == 0 || GBH == 0) {