diff options
| author | Oliver Chang <ochang@chromium.org> | 2016-01-14 11:50:00 -0800 |
|---|---|---|
| committer | Oliver Chang <ochang@chromium.org> | 2016-01-14 11:50:00 -0800 |
| commit | 0b56371b1e9683676cf191f2d9d41d40d47c3726 (patch) | |
| tree | cf4295a57ecd0b7c03e758735cd6635f1e45ead4 /third_party/libopenjpeg20/pi.c | |
| parent | 8694bf8ac331d9a94d62d86465d599eee54486d0 (diff) | |
| download | pdfium-0b56371b1e9683676cf191f2d9d41d40d47c3726.tar.xz | |
openjpeg: Fix potential bad precno value in opj_pi_next* functions.
R=thestig@chromium.org
BUG=571479
Review URL: https://codereview.chromium.org/1585243003 .
Diffstat (limited to 'third_party/libopenjpeg20/pi.c')
| -rw-r--r-- | third_party/libopenjpeg20/pi.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/third_party/libopenjpeg20/pi.c b/third_party/libopenjpeg20/pi.c index 06f1e41157..462e07c836 100644 --- a/third_party/libopenjpeg20/pi.c +++ b/third_party/libopenjpeg20/pi.c @@ -377,6 +377,9 @@ if (!pi->tp_on){ prcj = opj_int_floordivpow2(opj_int_ceildiv(pi->y, (OPJ_INT32)(comp->dy << levelno)), (OPJ_INT32)res->pdy) - opj_int_floordivpow2(try0, (OPJ_INT32)res->pdy); pi->precno = (OPJ_UINT32)(prci + prcj * (OPJ_INT32)res->pw); + if (pi->precno >= res->pw * res->ph) { + return OPJ_FALSE; + } for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) { index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p; if (!pi->include[index]) { @@ -458,6 +461,9 @@ static OPJ_BOOL opj_pi_next_pcrl(opj_pi_iterator_t * pi) { prcj = opj_int_floordivpow2(opj_int_ceildiv(pi->y, (OPJ_INT32)(comp->dy << levelno)), (OPJ_INT32)res->pdy) - opj_int_floordivpow2(try0, (OPJ_INT32)res->pdy); pi->precno = (OPJ_UINT32)(prci + prcj * (OPJ_INT32)res->pw); + if (pi->precno >= res->pw * res->ph) { + return OPJ_FALSE; + } for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) { index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p; if (!pi->include[index]) { @@ -537,6 +543,9 @@ static OPJ_BOOL opj_pi_next_cprl(opj_pi_iterator_t * pi) { prcj = opj_int_floordivpow2(opj_int_ceildiv(pi->y, (OPJ_INT32)(comp->dy << levelno)), (OPJ_INT32)res->pdy) - opj_int_floordivpow2(try0, (OPJ_INT32)res->pdy); pi->precno = (OPJ_UINT32)(prci + prcj * (OPJ_INT32)res->pw); + if (pi->precno >= res->pw * res->ph) { + return OPJ_FALSE; + } for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) { index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p; if (!pi->include[index]) { |