diff options
| author | Lei Zhang <thestig@chromium.org> | 2018-07-06 21:11:39 +0000 |
|---|---|---|
| committer | Chromium commit bot <commit-bot@chromium.org> | 2018-07-06 21:11:39 +0000 |
| commit | ee7c8c3f37698651ae57e2aea979b3dba1c8b39a (patch) | |
| tree | e56b0dab091ebf42394f3182d9b1d2f414ff37ae /core | |
| parent | 4caa1200938a397d7f2f193872355129adb768ed (diff) | |
| download | pdfium-ee7c8c3f37698651ae57e2aea979b3dba1c8b39a.tar.xz | |
Fix regression in CJBig2_TRDProc.chromium/3486chromium/3485chromium/3484
Commit 7695dd0f mistakenly changed a signed integer to unsigned. This is
incorrect because right shifts for negative integers behave differently.
BUG=chromium:859284
Change-Id: Id9c54848b15ace1de080c174f261dd2c064018e0
Reviewed-on: https://pdfium-review.googlesource.com/37230
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
Diffstat (limited to 'core')
| -rw-r--r-- | core/fxcodec/jbig2/JBig2_TrdProc.cpp | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/core/fxcodec/jbig2/JBig2_TrdProc.cpp b/core/fxcodec/jbig2/JBig2_TrdProc.cpp index 4790f6657c..79b2142a9f 100644 --- a/core/fxcodec/jbig2/JBig2_TrdProc.cpp +++ b/core/fxcodec/jbig2/JBig2_TrdProc.cpp @@ -27,11 +27,11 @@ Optional<uint32_t> CheckTRDDimension(uint32_t dimension, int32_t delta) { return {result.ValueOrDie()}; } -Optional<int32_t> CheckTRDReferenceDimension(uint32_t dimension, - uint32_t divisor, +Optional<int32_t> CheckTRDReferenceDimension(int32_t dimension, + uint32_t shift, int32_t offset) { FX_SAFE_INT32 result = offset; - result += dimension / divisor; + result += dimension >> shift; if (!result.IsValid()) return {}; return {result.ValueOrDie()}; @@ -162,9 +162,9 @@ std::unique_ptr<CJBig2_Image> CJBig2_TRDProc::DecodeHuffman( return nullptr; Optional<int32_t> GRREFERENCEDX = - CheckTRDReferenceDimension(RDWI, 4, RDXI); + CheckTRDReferenceDimension(RDWI, 2, RDXI); Optional<int32_t> GRREFERENCEDY = - CheckTRDReferenceDimension(RDHI, 4, RDYI); + CheckTRDReferenceDimension(RDHI, 2, RDYI); if (!GRREFERENCEDX || !GRREFERENCEDY) return nullptr; @@ -342,9 +342,9 @@ std::unique_ptr<CJBig2_Image> CJBig2_TRDProc::DecodeArith( return nullptr; Optional<int32_t> GRREFERENCEDX = - CheckTRDReferenceDimension(RDWI, 2, RDXI); + CheckTRDReferenceDimension(RDWI, 1, RDXI); Optional<int32_t> GRREFERENCEDY = - CheckTRDReferenceDimension(RDHI, 2, RDYI); + CheckTRDReferenceDimension(RDHI, 1, RDYI); if (!GRREFERENCEDX || !GRREFERENCEDY) return nullptr; |