summaryrefslogtreecommitdiff
path: root/core
diff options
context:
space:
mode:
authorLei Zhang <thestig@chromium.org>2015-05-08 13:52:49 -0700
committerLei Zhang <thestig@chromium.org>2015-05-08 13:52:49 -0700
commitea7b333c73ea3e1847e79cabdd85853af67d6d6c (patch)
tree4f04b9ab62d02b4a3050d914008260611ea575c8 /core
parenteff208f03dc7ea7606a3dc03150291f264147d60 (diff)
downloadpdfium-ea7b333c73ea3e1847e79cabdd85853af67d6d6c.tar.xz
Merge to XFA: Fix a bunch of -Wunused-but-set-variable warnings.
Also fix a few nits and other errors along the way. Review URL: https://codereview.chromium.org/1098583002 Review URL: https://codereview.chromium.org/1135713004 (cherry picked from commit f0a169e6fd5718995fa6ef8749c8d16cdad84985) (cherry picked from commit 470408c2ffe71e99cebad0d1d6887f1723f02cef) R=tsepez@chromium.org Review URL: https://codereview.chromium.org/1133453006
Diffstat (limited to 'core')
-rw-r--r--core/include/fxcrt/fx_system.h1
-rw-r--r--core/src/fpdfapi/fpdf_page/pageint.h3
-rw-r--r--core/src/fpdfapi/fpdf_render/fpdf_render_pattern.cpp3
-rw-r--r--core/src/fpdftext/fpdf_text.cpp1
-rw-r--r--core/src/fpdftext/fpdf_text_int.cpp7
-rw-r--r--core/src/fxcodec/codec/fx_codec_jpx_opj.cpp81
-rw-r--r--core/src/fxcodec/jbig2/JBig2_GeneralDecoder.cpp10
-rw-r--r--core/src/fxge/dib/fx_dib_composite.cpp10
-rw-r--r--core/src/fxge/dib/fx_dib_transform.cpp2
-rw-r--r--core/src/fxge/ge/fx_ge_fontmap.cpp19
10 files changed, 59 insertions, 78 deletions
diff --git a/core/include/fxcrt/fx_system.h b/core/include/fxcrt/fx_system.h
index e1e957a52d..37af19c769 100644
--- a/core/include/fxcrt/fx_system.h
+++ b/core/include/fxcrt/fx_system.h
@@ -95,6 +95,7 @@ typedef int FX_ERR;
typedef char FX_CHAR;
typedef char* FX_LPSTR;
typedef char const* FX_LPCSTR;
+#define FX_DWORD_MAX UINT_MAX
typedef unsigned int FX_DWORD;
typedef unsigned int* FX_LPDWORD;
#if _FXM_PLATFORM_ == _FXM_PLATFORM_WINDOWS_
diff --git a/core/src/fpdfapi/fpdf_page/pageint.h b/core/src/fpdfapi/fpdf_page/pageint.h
index 73c6ec4121..93f34e51a2 100644
--- a/core/src/fpdfapi/fpdf_page/pageint.h
+++ b/core/src/fpdfapi/fpdf_page/pageint.h
@@ -423,8 +423,9 @@ public:
~CPDF_IccProfile();
FX_INT32 GetComponents() const { return m_nSrcComponents; }
FX_BOOL m_bsRGB;
- FX_INT32 m_nSrcComponents;
FX_LPVOID m_pTransform;
+private:
+ FX_INT32 m_nSrcComponents;
};
class CPDF_DeviceCS : public CPDF_ColorSpace
{
diff --git a/core/src/fpdfapi/fpdf_render/fpdf_render_pattern.cpp b/core/src/fpdfapi/fpdf_render/fpdf_render_pattern.cpp
index 7e2a13a406..2d7e1aeb93 100644
--- a/core/src/fpdfapi/fpdf_render/fpdf_render_pattern.cpp
+++ b/core/src/fpdfapi/fpdf_render/fpdf_render_pattern.cpp
@@ -1095,13 +1095,11 @@ void CPDF_RenderStatus::DrawPathWithPattern(CPDF_PathObject* pPathObj, const CFX
}
void CPDF_RenderStatus::ProcessPathPattern(CPDF_PathObject* pPathObj, const CFX_AffineMatrix* pObj2Device, int& filltype, FX_BOOL& bStroke)
{
- FX_BOOL bPattern = FALSE;
if(filltype) {
CPDF_Color& FillColor = *pPathObj->m_ColorState.GetFillColor();
if(FillColor.m_pCS && FillColor.m_pCS->GetFamily() == PDFCS_PATTERN) {
DrawPathWithPattern(pPathObj, pObj2Device, &FillColor, FALSE);
filltype = 0;
- bPattern = TRUE;
}
}
if(bStroke) {
@@ -1109,7 +1107,6 @@ void CPDF_RenderStatus::ProcessPathPattern(CPDF_PathObject* pPathObj, const CFX_
if(StrokeColor.m_pCS && StrokeColor.m_pCS->GetFamily() == PDFCS_PATTERN) {
DrawPathWithPattern(pPathObj, pObj2Device, &StrokeColor, TRUE);
bStroke = FALSE;
- bPattern = TRUE;
}
}
}
diff --git a/core/src/fpdftext/fpdf_text.cpp b/core/src/fpdftext/fpdf_text.cpp
index d6d6de9a83..e1902a3764 100644
--- a/core/src/fpdftext/fpdf_text.cpp
+++ b/core/src/fpdftext/fpdf_text.cpp
@@ -148,7 +148,6 @@ void CTextPage::ProcessObject(CPDF_PageObject* pObject)
topy, bottomy, spacew, fontsize_v, segment, pFont);
FX_Free(pPosArray);
}
-static void ConvertPDFString(CFX_ByteString& result, CFX_ByteString& src, CPDF_Font* pFont);
CTextBaseLine* CTextPage::InsertTextBox(CTextBaseLine* pBaseLine, FX_FLOAT basey, FX_FLOAT leftx,
FX_FLOAT rightx, FX_FLOAT topy, FX_FLOAT bottomy, FX_FLOAT spacew, FX_FLOAT fontsize_v,
CFX_ByteString& str, CPDF_Font* pFont)
diff --git a/core/src/fpdftext/fpdf_text_int.cpp b/core/src/fpdftext/fpdf_text_int.cpp
index 54dc915e56..f19d3de9dc 100644
--- a/core/src/fpdftext/fpdf_text_int.cpp
+++ b/core/src/fpdftext/fpdf_text_int.cpp
@@ -1364,8 +1364,6 @@ void CPDF_TextPage::CloseTempLine()
}
}
}
- int ntext = m_TextBuf.GetSize();
- ntext = m_charList.GetSize();
order.RemoveAll();
m_TempCharList.RemoveAll();
m_TempTextBuf.Delete(0, m_TempTextBuf.GetLength());
@@ -2500,7 +2498,6 @@ void CPDF_TextPageFind::ExtractFindWhat(const CFX_WideString& findwhat)
}
}
int pos = 0;
- FX_BOOL bLastIgnore = FALSE;
while(pos < csWord.GetLength()) {
CFX_WideString curStr = csWord.Mid(pos, 1);
FX_WCHAR curChar = csWord.GetAt(pos);
@@ -2520,10 +2517,7 @@ void CPDF_TextPageFind::ExtractFindWhat(const CFX_WideString& findwhat)
}
csWord = csWord.Right(csWord.GetLength() - pos - 1);
pos = 0;
- bLastIgnore = TRUE;
continue;
- } else {
- bLastIgnore = FALSE;
}
pos++;
}
@@ -2532,7 +2526,6 @@ void CPDF_TextPageFind::ExtractFindWhat(const CFX_WideString& findwhat)
}
index++;
}
- return;
}
FX_BOOL CPDF_TextPageFind::IsMatchWholeWord(const CFX_WideString& csPageText, int startPos, int endPos)
{
diff --git a/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp b/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp
index 3b0490f3c6..3546f574f9 100644
--- a/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp
+++ b/core/src/fxcodec/codec/fx_codec_jpx_opj.cpp
@@ -351,25 +351,24 @@ void color_sycc_to_rgb(opj_image_t *img)
}
void color_apply_icc_profile(opj_image_t *image)
{
- cmsHPROFILE in_prof, out_prof;
- cmsHTRANSFORM transform;
- cmsColorSpaceSignature in_space, out_space;
- cmsUInt32Number intent, in_type, out_type, nr_samples;
- int *r, *g, *b;
- int prec, i, max, max_w, max_h;
- OPJ_COLOR_SPACE oldspace;
- in_prof =
+ cmsHPROFILE out_prof;
+ cmsUInt32Number in_type;
+ cmsUInt32Number out_type;
+ int *r;
+ int *g;
+ int *b;
+ int max;
+ cmsHPROFILE in_prof =
cmsOpenProfileFromMem(image->icc_profile_buf, image->icc_profile_len);
if(in_prof == NULL) {
return;
}
- in_space = cmsGetPCS(in_prof);
- out_space = cmsGetColorSpace(in_prof);
- intent = cmsGetHeaderRenderingIntent(in_prof);
- max_w = (int)image->comps[0].w;
- max_h = (int)image->comps[0].h;
- prec = (int)image->comps[0].prec;
- oldspace = image->color_space;
+ cmsColorSpaceSignature out_space = cmsGetColorSpace(in_prof);
+ cmsUInt32Number intent = cmsGetHeaderRenderingIntent(in_prof);
+ int max_w = (int)image->comps[0].w;
+ int max_h = (int)image->comps[0].h;
+ int prec = (int)image->comps[0].prec;
+ OPJ_COLOR_SPACE oldspace = image->color_space;
if(out_space == cmsSigRgbData) {
if( prec <= 8 ) {
in_type = TYPE_RGB_8;
@@ -398,8 +397,8 @@ void color_apply_icc_profile(opj_image_t *image)
} else {
return;
}
- transform = cmsCreateTransform(in_prof, in_type,
- out_prof, out_type, intent, 0);
+ cmsHTRANSFORM transform =
+ cmsCreateTransform(in_prof, in_type, out_prof, out_type, intent, 0);
cmsCloseProfile(in_prof);
cmsCloseProfile(out_prof);
if(transform == NULL) {
@@ -410,13 +409,13 @@ void color_apply_icc_profile(opj_image_t *image)
if( prec <= 8 ) {
unsigned char *inbuf, *outbuf, *in, *out;
max = max_w * max_h;
- nr_samples = (cmsUInt32Number)max * 3 * (cmsUInt32Number)sizeof(unsigned char);
+ cmsUInt32Number nr_samples = max * 3 * sizeof(unsigned char);
in = inbuf = FX_Alloc(unsigned char, nr_samples);
out = outbuf = FX_Alloc(unsigned char, nr_samples);
r = image->comps[0].data;
g = image->comps[1].data;
b = image->comps[2].data;
- for(i = 0; i < max; ++i) {
+ for(int i = 0; i < max; ++i) {
*in++ = (unsigned char) * r++;
*in++ = (unsigned char) * g++;
*in++ = (unsigned char) * b++;
@@ -425,7 +424,7 @@ void color_apply_icc_profile(opj_image_t *image)
r = image->comps[0].data;
g = image->comps[1].data;
b = image->comps[2].data;
- for(i = 0; i < max; ++i) {
+ for(int i = 0; i < max; ++i) {
*r++ = (int) * out++;
*g++ = (int) * out++;
*b++ = (int) * out++;
@@ -435,13 +434,13 @@ void color_apply_icc_profile(opj_image_t *image)
} else {
unsigned short *inbuf, *outbuf, *in, *out;
max = max_w * max_h;
- nr_samples = (cmsUInt32Number)max * 3 * (cmsUInt32Number)sizeof(unsigned short);
+ cmsUInt32Number nr_samples = max * 3 * sizeof(unsigned short);
in = inbuf = FX_Alloc(unsigned short, nr_samples);
out = outbuf = FX_Alloc(unsigned short, nr_samples);
r = image->comps[0].data;
g = image->comps[1].data;
b = image->comps[2].data;
- for(i = 0; i < max; ++i) {
+ for(int i = 0; i < max; ++i) {
*in++ = (unsigned short) * r++;
*in++ = (unsigned short) * g++;
*in++ = (unsigned short) * b++;
@@ -450,7 +449,7 @@ void color_apply_icc_profile(opj_image_t *image)
r = image->comps[0].data;
g = image->comps[1].data;
b = image->comps[2].data;
- for(i = 0; i < max; ++i) {
+ for(int i = 0; i < max; ++i) {
*r++ = (int) * out++;
*g++ = (int) * out++;
*b++ = (int) * out++;
@@ -461,7 +460,8 @@ void color_apply_icc_profile(opj_image_t *image)
} else {
unsigned char *in, *inbuf, *out, *outbuf;
max = max_w * max_h;
- nr_samples = (cmsUInt32Number)max * 3 * sizeof(unsigned char);
+ cmsUInt32Number nr_samples =
+ (cmsUInt32Number)max * 3 * sizeof(unsigned char);
in = inbuf = FX_Alloc(unsigned char, nr_samples);
out = outbuf = FX_Alloc(unsigned char, nr_samples);
image->comps = (opj_image_comp_t*)
@@ -477,14 +477,14 @@ void color_apply_icc_profile(opj_image_t *image)
FXSYS_memset8(image->comps[2].data, 0, sizeof(int) * (size_t)max);
image->numcomps += 2;
r = image->comps[0].data;
- for(i = 0; i < max; ++i) {
+ for(int i = 0; i < max; ++i) {
*in++ = (unsigned char) * r++;
}
cmsDoTransform(transform, inbuf, outbuf, (cmsUInt32Number)max);
r = image->comps[0].data;
g = image->comps[1].data;
b = image->comps[2].data;
- for(i = 0; i < max; ++i) {
+ for(int i = 0; i < max; ++i) {
*r++ = (int) * out++;
*g++ = (int) * out++;
*b++ = (int) * out++;
@@ -508,14 +508,12 @@ void color_apply_conversion(opj_image_t *image)
int *L, *a, *b, *red, *green, *blue, *src0, *src1, *src2;
double rl, ol, ra, oa, rb, ob, prec0, prec1, prec2;
double minL, maxL, mina, maxa, minb, maxb;
- unsigned int default_type, il;
- unsigned int i, max, illu;
+ unsigned int default_type;
+ unsigned int i, max;
cmsHPROFILE in, out;
cmsHTRANSFORM transform;
cmsUInt16Number RGB[3];
cmsCIELab Lab;
- illu = 0;
- il = 0;
in = cmsCreateLab4Profile(NULL);
out = cmsCreate_sRGBProfile();
transform =
@@ -706,10 +704,7 @@ void CJPX_Decoder::GetInfo(FX_DWORD& width, FX_DWORD& height, FX_DWORD& codestre
}
FX_BOOL CJPX_Decoder::Decode(FX_LPBYTE dest_buf, int pitch, FX_BOOL bTranslateColor, FX_LPBYTE offsets)
{
- FX_BYTE** channel_bufs;
- int* adjust_comps;
int i, wid, hei, row, col, channel, src;
- FX_BOOL flag;
FX_LPBYTE pChannel, pScanline, pPixel;
if(image->comps[0].w != image->x1 || image->comps[0].h != image->y1) {
@@ -719,16 +714,15 @@ FX_BOOL CJPX_Decoder::Decode(FX_LPBYTE dest_buf, int pitch, FX_BOOL bTranslateCo
return FALSE;
}
FXSYS_memset8(dest_buf, 0xff, image->y1 * pitch);
- channel_bufs = FX_Alloc(FX_BYTE*, image->numcomps);
+ FX_BYTE** channel_bufs = FX_Alloc(FX_BYTE*, image->numcomps);
if (channel_bufs == NULL) {
return FALSE;
}
- adjust_comps = FX_Alloc(int, image->numcomps);
+ FX_BOOL result = FALSE;
+ int* adjust_comps = FX_Alloc(int, image->numcomps);
if (adjust_comps == NULL) {
- FX_Free(channel_bufs);
- return FALSE;
+ goto done;
}
- flag = TRUE;
for (i = 0; i < (int)image->numcomps; i ++) {
channel_bufs[i] = dest_buf + offsets[i];
adjust_comps[i] = image->comps[i].prec - 8;
@@ -736,8 +730,7 @@ FX_BOOL CJPX_Decoder::Decode(FX_LPBYTE dest_buf, int pitch, FX_BOOL bTranslateCo
if(image->comps[i].dx != image->comps[i - 1].dx
|| image->comps[i].dy != image->comps[i - 1].dy
|| image->comps[i].prec != image->comps[i - 1].prec) {
- flag = FALSE;
- goto failed;
+ goto done;
}
}
}
@@ -784,14 +777,12 @@ FX_BOOL CJPX_Decoder::Decode(FX_LPBYTE dest_buf, int pitch, FX_BOOL bTranslateCo
}
}
}
+ result = TRUE;
+done:
FX_Free(channel_bufs);
FX_Free(adjust_comps);
- return TRUE;
-failed:
- FX_Free(channel_bufs);
- FX_Free(adjust_comps);
- return FALSE;
+ return result;
}
void initialize_transition_table();
void initialize_significance_luts();
diff --git a/core/src/fxcodec/jbig2/JBig2_GeneralDecoder.cpp b/core/src/fxcodec/jbig2/JBig2_GeneralDecoder.cpp
index 53faab4a46..a5928f9ea3 100644
--- a/core/src/fxcodec/jbig2/JBig2_GeneralDecoder.cpp
+++ b/core/src/fxcodec/jbig2/JBig2_GeneralDecoder.cpp
@@ -888,7 +888,7 @@ CJBig2_Image *CJBig2_GRDProc::decode_Arith_Template3_opt2(CJBig2_ArithDecoder *p
CJBig2_Image *GBREG;
FX_DWORD line1;
FX_BYTE *pLine, cVal;
- FX_INTPTR nStride, nStride2;
+ FX_INTPTR nStride;
FX_INT32 nBits, k;
LTP = 0;
JBIG2_ALLOC(GBREG, CJBig2_Image(GBW, GBH));
@@ -899,7 +899,6 @@ CJBig2_Image *CJBig2_GRDProc::decode_Arith_Template3_opt2(CJBig2_ArithDecoder *p
}
pLine = GBREG->m_pData;
nStride = GBREG->m_nStride;
- nStride2 = nStride << 1;
for(FX_DWORD h = 0; h < GBH; h++) {
if(TPGDON) {
SLTP = pArithDecoder->DECODE(&gbContext[0x0195]);
@@ -2335,7 +2334,7 @@ CJBig2_SymbolDict *CJBig2_SDDProc::decode_Arith(CJBig2_ArithDecoder *pArithDecod
CJBig2_Image **SDNEWSYMS;
FX_DWORD HCHEIGHT, NSYMSDECODED;
FX_INT32 HCDH;
- FX_DWORD SYMWIDTH, TOTWIDTH, HCFIRSTSYM;
+ FX_DWORD SYMWIDTH, TOTWIDTH;
FX_INT32 DW;
CJBig2_Image *BS;
FX_DWORD I, J, REFAGGNINST;
@@ -2345,7 +2344,6 @@ CJBig2_SymbolDict *CJBig2_SDDProc::decode_Arith(CJBig2_ArithDecoder *pArithDecod
FX_DWORD EXRUNLENGTH;
FX_INT32 nVal;
FX_DWORD nTmp;
- FX_BOOL SBHUFF;
FX_DWORD SBNUMSYMS;
FX_BYTE SBSYMCODELEN;
FX_DWORD IDI;
@@ -2394,7 +2392,6 @@ CJBig2_SymbolDict *CJBig2_SDDProc::decode_Arith(CJBig2_ArithDecoder *pArithDecod
}
SYMWIDTH = 0;
TOTWIDTH = 0;
- HCFIRSTSYM = NSYMSDECODED;
for(;;) {
nVal = IADW->decode(pArithDecoder, &DW);
if(nVal == JBIG2_OOB) {
@@ -2537,7 +2534,6 @@ CJBig2_SymbolDict *CJBig2_SDDProc::decode_Arith(CJBig2_ArithDecoder *pArithDecod
delete SBHUFFRSIZE;
delete pDecoder;
} else if(REFAGGNINST == 1) {
- SBHUFF = SDHUFF;
SBNUMSYMS = SDNUMINSYMS + NSYMSDECODED;
if(IAID->decode(pArithDecoder, (int*)&IDI) == -1) {
m_pModule->JBig2_Error("symbol dictionary decoding procedure (arith): too short.");
@@ -2686,7 +2682,6 @@ CJBig2_SymbolDict *CJBig2_SDDProc::decode_Huffman(CJBig2_BitStream *pStream,
FX_DWORD EXRUNLENGTH;
FX_INT32 nVal, nBits;
FX_DWORD nTmp;
- FX_BOOL SBHUFF;
FX_DWORD SBNUMSYMS;
FX_BYTE SBSYMCODELEN;
JBig2HuffmanCode *SBSYMCODES;
@@ -2843,7 +2838,6 @@ CJBig2_SymbolDict *CJBig2_SDDProc::decode_Huffman(CJBig2_BitStream *pStream,
delete SBHUFFRSIZE;
delete pDecoder;
} else if(REFAGGNINST == 1) {
- SBHUFF = SDHUFF;
SBNUMSYMS = SDNUMINSYMS + SDNUMNEWSYMS;
nTmp = 1;
while((FX_DWORD)(1 << nTmp) < SBNUMSYMS) {
diff --git a/core/src/fxge/dib/fx_dib_composite.cpp b/core/src/fxge/dib/fx_dib_composite.cpp
index 375b7c110e..ae72fc5a43 100644
--- a/core/src/fxge/dib/fx_dib_composite.cpp
+++ b/core/src/fxge/dib/fx_dib_composite.cpp
@@ -4148,15 +4148,7 @@ FX_BOOL CFX_DIBitmap::CompositeBitmap(int dest_left, int dest_top, int width, in
}
int dest_Bpp = m_bpp / 8;
int src_Bpp = pSrcBitmap->GetBPP() / 8;
- FX_BOOL bRgb = FALSE;
- FX_BOOL bCmyk = FALSE;
- if (src_Bpp > 1) {
- if (pSrcBitmap->IsCmykImage()) {
- bCmyk = TRUE;
- } else {
- bRgb = TRUE;
- }
- }
+ FX_BOOL bRgb = src_Bpp > 1 && !pSrcBitmap->IsCmykImage();
CFX_DIBitmap* pSrcAlphaMask = pSrcBitmap->m_pAlphaMask;
for (int row = 0; row < height; row ++) {
FX_LPBYTE dest_scan = m_pBuffer + (dest_top + row) * m_Pitch + dest_left * dest_Bpp;
diff --git a/core/src/fxge/dib/fx_dib_transform.cpp b/core/src/fxge/dib/fx_dib_transform.cpp
index 65afdd6b3a..a9a1e66d99 100644
--- a/core/src/fxge/dib/fx_dib_transform.cpp
+++ b/core/src/fxge/dib/fx_dib_transform.cpp
@@ -73,7 +73,6 @@ CFX_DIBitmap* CFX_DIBSource::SwapXY(FX_BOOL bXFlip, FX_BOOL bYFlip, const FX_REC
return NULL;
}
pTransBitmap->CopyPalette(m_pPalette);
- int src_pitch = m_Pitch;
int dest_pitch = pTransBitmap->GetPitch();
FX_LPBYTE dest_buf = pTransBitmap->GetBuffer();
int row_start = bXFlip ? m_Height - dest_clip.right : dest_clip.left;
@@ -133,7 +132,6 @@ CFX_DIBitmap* CFX_DIBSource::SwapXY(FX_BOOL bXFlip, FX_BOOL bYFlip, const FX_REC
}
}
if (m_pAlphaMask) {
- src_pitch = m_pAlphaMask->m_Pitch;
dest_pitch = pTransBitmap->m_pAlphaMask->GetPitch();
dest_buf = pTransBitmap->m_pAlphaMask->GetBuffer();
int dest_step = bYFlip ? -dest_pitch : dest_pitch;
diff --git a/core/src/fxge/ge/fx_ge_fontmap.cpp b/core/src/fxge/ge/fx_ge_fontmap.cpp
index 9a8380b77e..c668f54834 100644
--- a/core/src/fxge/ge/fx_ge_fontmap.cpp
+++ b/core/src/fxge/ge/fx_ge_fontmap.cpp
@@ -1464,14 +1464,29 @@ void CFX_FolderFontInfo::ScanFile(CFX_ByteString& path)
FX_BYTE buffer[16];
FXSYS_fseek(pFile, 0, FXSYS_SEEK_SET);
size_t readCnt = FXSYS_fread(buffer, 12, 1, pFile);
+ if (readCnt != 1) {
+ FXSYS_fclose(pFile);
+ return;
+ }
+
if (GET_TT_LONG(buffer) == 0x74746366) {
FX_DWORD nFaces = GET_TT_LONG(buffer + 8);
- FX_LPBYTE offsets = FX_Alloc(FX_BYTE, nFaces * 4);
+ if (nFaces > FX_DWORD_MAX / 4) {
+ FXSYS_fclose(pFile);
+ return;
+ }
+ FX_DWORD face_bytes = nFaces * 4;
+ FX_LPBYTE offsets = FX_Alloc(FX_BYTE, face_bytes);
if (!offsets) {
FXSYS_fclose(pFile);
return;
}
- readCnt = FXSYS_fread(offsets, nFaces * 4, 1, pFile);
+ readCnt = FXSYS_fread(offsets, face_bytes, 1, pFile);
+ if (readCnt != face_bytes) {
+ FX_Free(offsets);
+ FXSYS_fclose(pFile);
+ return;
+ }
for (FX_DWORD i = 0; i < nFaces; i ++) {
FX_LPBYTE p = offsets + i * 4;
ReportFace(path, pFile, filesize, GET_TT_LONG(p));