summaryrefslogtreecommitdiff
path: root/core
diff options
context:
space:
mode:
authorLei Zhang <thestig@chromium.org>2017-09-08 15:38:21 -0700
committerChromium commit bot <commit-bot@chromium.org>2017-09-08 22:51:02 +0000
commit131c0eb2e34ece6ede6288842cb3004ec3c600d4 (patch)
tree383145ce921ee64e71d8dc949e36c7b4e9590e65 /core
parentee1e757902d0096cc482c74d4fc0e568e0b18541 (diff)
downloadpdfium-131c0eb2e34ece6ede6288842cb3004ec3c600d4.tar.xz
Fix an off by 1 error in TIFF_PredictLine().chromium/3212
BUG=chromium:762106 Change-Id: I714d69320cc4fb81d535f811c18d4ef91fec44d3 Reviewed-on: https://pdfium-review.googlesource.com/13212 Commit-Queue: Lei Zhang <thestig@chromium.org> Reviewed-by: Tom Sepez <tsepez@chromium.org>
Diffstat (limited to 'core')
-rw-r--r--core/fxcodec/codec/fx_codec_flate.cpp2
1 files changed, 1 insertions, 1 deletions
diff --git a/core/fxcodec/codec/fx_codec_flate.cpp b/core/fxcodec/codec/fx_codec_flate.cpp
index 02be295ce6..6482d52ed8 100644
--- a/core/fxcodec/codec/fx_codec_flate.cpp
+++ b/core/fxcodec/codec/fx_codec_flate.cpp
@@ -472,7 +472,7 @@ void TIFF_PredictLine(uint8_t* dest_buf,
}
int BytesPerPixel = BitsPerComponent * Colors / 8;
if (BitsPerComponent == 16) {
- for (uint32_t i = BytesPerPixel; i < row_size; i += 2) {
+ for (uint32_t i = BytesPerPixel; i + 1 < row_size; i += 2) {
uint16_t pixel =
(dest_buf[i - BytesPerPixel] << 8) | dest_buf[i - BytesPerPixel + 1];
pixel += (dest_buf[i] << 8) | dest_buf[i + 1];