summaryrefslogtreecommitdiff
path: root/core
diff options
context:
space:
mode:
authorLei Zhang <thestig@chromium.org>2018-07-06 21:11:39 +0000
committerChromium commit bot <commit-bot@chromium.org>2018-07-06 21:11:39 +0000
commitee7c8c3f37698651ae57e2aea979b3dba1c8b39a (patch)
treee56b0dab091ebf42394f3182d9b1d2f414ff37ae /core
parent4caa1200938a397d7f2f193872355129adb768ed (diff)
downloadpdfium-ee7c8c3f37698651ae57e2aea979b3dba1c8b39a.tar.xz
Fix regression in CJBig2_TRDProc.chromium/3486chromium/3485chromium/3484
Commit 7695dd0f mistakenly changed a signed integer to unsigned. This is incorrect because right shifts for negative integers behave differently. BUG=chromium:859284 Change-Id: Id9c54848b15ace1de080c174f261dd2c064018e0 Reviewed-on: https://pdfium-review.googlesource.com/37230 Reviewed-by: Henrique Nakashima <hnakashima@chromium.org> Commit-Queue: Lei Zhang <thestig@chromium.org>
Diffstat (limited to 'core')
-rw-r--r--core/fxcodec/jbig2/JBig2_TrdProc.cpp14
1 files changed, 7 insertions, 7 deletions
diff --git a/core/fxcodec/jbig2/JBig2_TrdProc.cpp b/core/fxcodec/jbig2/JBig2_TrdProc.cpp
index 4790f6657c..79b2142a9f 100644
--- a/core/fxcodec/jbig2/JBig2_TrdProc.cpp
+++ b/core/fxcodec/jbig2/JBig2_TrdProc.cpp
@@ -27,11 +27,11 @@ Optional<uint32_t> CheckTRDDimension(uint32_t dimension, int32_t delta) {
return {result.ValueOrDie()};
}
-Optional<int32_t> CheckTRDReferenceDimension(uint32_t dimension,
- uint32_t divisor,
+Optional<int32_t> CheckTRDReferenceDimension(int32_t dimension,
+ uint32_t shift,
int32_t offset) {
FX_SAFE_INT32 result = offset;
- result += dimension / divisor;
+ result += dimension >> shift;
if (!result.IsValid())
return {};
return {result.ValueOrDie()};
@@ -162,9 +162,9 @@ std::unique_ptr<CJBig2_Image> CJBig2_TRDProc::DecodeHuffman(
return nullptr;
Optional<int32_t> GRREFERENCEDX =
- CheckTRDReferenceDimension(RDWI, 4, RDXI);
+ CheckTRDReferenceDimension(RDWI, 2, RDXI);
Optional<int32_t> GRREFERENCEDY =
- CheckTRDReferenceDimension(RDHI, 4, RDYI);
+ CheckTRDReferenceDimension(RDHI, 2, RDYI);
if (!GRREFERENCEDX || !GRREFERENCEDY)
return nullptr;
@@ -342,9 +342,9 @@ std::unique_ptr<CJBig2_Image> CJBig2_TRDProc::DecodeArith(
return nullptr;
Optional<int32_t> GRREFERENCEDX =
- CheckTRDReferenceDimension(RDWI, 2, RDXI);
+ CheckTRDReferenceDimension(RDWI, 1, RDXI);
Optional<int32_t> GRREFERENCEDY =
- CheckTRDReferenceDimension(RDHI, 2, RDYI);
+ CheckTRDReferenceDimension(RDHI, 1, RDYI);
if (!GRREFERENCEDX || !GRREFERENCEDY)
return nullptr;