summaryrefslogtreecommitdiff
path: root/fpdfsdk/src
diff options
context:
space:
mode:
authorJUN FANG <jun_fang@foxitsoftware.com>2014-07-30 13:46:39 -0700
committerJUN FANG <jun_fang@foxitsoftware.com>2014-07-30 13:46:39 -0700
commit8dee6cab8f10a257d3b551ede6ca85466bf0bac7 (patch)
tree418391fde70ddb1e7ee91d2e14e6c3bbf8f29107 /fpdfsdk/src
parent0d3b5cc6028550205b56a80ccdd81aecf67e4508 (diff)
downloadpdfium-8dee6cab8f10a257d3b551ede6ca85466bf0bac7.tar.xz
Fix the potential integer overflow from 'offset+size' in extension.h and fpdfview.cpp
BUG=397258 R=tsepez@chromium.org Review URL: https://codereview.chromium.org/419063002
Diffstat (limited to 'fpdfsdk/src')
-rw-r--r--fpdfsdk/src/fpdfview.cpp32
1 files changed, 24 insertions, 8 deletions
diff --git a/fpdfsdk/src/fpdfview.cpp b/fpdfsdk/src/fpdfview.cpp
index b950ed8641..63d4fbdcde 100644
--- a/fpdfsdk/src/fpdfview.cpp
+++ b/fpdfsdk/src/fpdfview.cpp
@@ -9,7 +9,7 @@
#include "../include/fsdk_rendercontext.h"
#include "../include/fpdf_progressive.h"
#include "../include/fpdf_ext.h"
-
+#include "../../third_party/numerics/safe_conversions_impl.h"
CPDF_CustomAccess::CPDF_CustomAccess(FPDF_FILEACCESS* pFileAccess)
{
@@ -35,18 +35,27 @@ FX_BOOL CPDF_CustomAccess::GetByte(FX_DWORD pos, FX_BYTE& ch)
FX_BOOL CPDF_CustomAccess::GetBlock(FX_DWORD pos, FX_LPBYTE pBuf, FX_DWORD size)
{
- if (pos + size > m_FileAccess.m_FileLen) return FALSE;
+ FX_SAFE_DWORD newPos = size;
+ newPos += pos;
+ if (!newPos.IsValid() || newPos.ValueOrDie() >= m_FileAccess.m_FileLen) {
+ return FALSE;
+ }
+
return m_FileAccess.m_GetBlock(m_FileAccess.m_Param, pos, pBuf, size);
}
FX_BOOL CPDF_CustomAccess::ReadBlock(void* buffer, FX_FILESIZE offset, size_t size)
{
- // m_FileAccess = *pFileAccess;
- // m_BufferOffset = (FX_DWORD)-1;
- if (offset + size > m_FileAccess.m_FileLen) return FALSE;
- return m_FileAccess.m_GetBlock(m_FileAccess.m_Param, offset,(FX_LPBYTE) buffer, size);
+ if (offset < 0) {
+ return FALSE;
+ }
+ FX_SAFE_FILESIZE newPos = base::checked_cast<FX_FILESIZE, size_t>(size);
+ newPos += offset;
+ if (!newPos.IsValid() || newPos.ValueOrDie() >= m_FileAccess.m_FileLen) {
+ return FALSE;
+ }
- // return FALSE;
+ return m_FileAccess.m_GetBlock(m_FileAccess.m_Param, offset,(FX_LPBYTE) buffer, size);
}
//0 bit: FPDF_POLICY_MACHINETIME_ACCESS
@@ -292,8 +301,15 @@ public:
virtual FX_FILESIZE GetSize() {return m_size;}
virtual FX_BOOL ReadBlock(void* buffer, FX_FILESIZE offset, size_t size)
{
- if(offset+size > (FX_DWORD)m_size) return FALSE;
+ if (offset < 0) {
+ return FALSE;
+ }
+
+ FX_SAFE_FILESIZE newPos = base::checked_cast<FX_FILESIZE, size_t>(size);
+ newPos += offset;
+ if (!newPos.IsValid() || newPos.ValueOrDie() >= (FX_DWORD)m_size) return FALSE;
FXSYS_memcpy(buffer, m_pBuf+offset, size);
+
return TRUE;
}
private: