diff options
| author | Nicolas Pena <npm@chromium.org> | 2017-05-11 11:12:33 -0400 |
|---|---|---|
| committer | Chromium commit bot <commit-bot@chromium.org> | 2017-05-11 16:09:22 +0000 |
| commit | 2a2ee0f1ca747929acaf1b4f2eadbf7c8e8025e6 (patch) | |
| tree | 39fd6639ff73cbb69f4c8e47291578d71f19f554 /third_party/libopenjpeg20/t1.c | |
| parent | 4da1e7623c52572bc8677ac53b908f39543f13b1 (diff) | |
| download | pdfium-2a2ee0f1ca747929acaf1b4f2eadbf7c8e8025e6.tar.xz | |
LibOpenJPEG: undefined shift in opj_t1_dec_clnpass
bpno_plus_one is used as a parameter bpno for a bunch of methods that calculate
1 << bpno. Thus, use a reduced value when it's large enough to cause undefined
shift. bpno_plus_one itself remains unchanged so that the number of calls
remains the same
Bug: chromium:698526
Change-Id: I40431d41a04f3e2315bd3c80114cd0fcbd2815b4
Reviewed-on: https://pdfium-review.googlesource.com/5310
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Nicolás Peña <npm@chromium.org>
Diffstat (limited to 'third_party/libopenjpeg20/t1.c')
| -rw-r--r-- | third_party/libopenjpeg20/t1.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/third_party/libopenjpeg20/t1.c b/third_party/libopenjpeg20/t1.c index 1ad850c77e..d290c38d52 100644 --- a/third_party/libopenjpeg20/t1.c +++ b/third_party/libopenjpeg20/t1.c @@ -1387,6 +1387,9 @@ static OPJ_BOOL opj_t1_decode_cblk(opj_t1_t *t1, } bpno_plus_one = (OPJ_INT32)(roishift + cblk->numbps); + if (bpno_plus_one > 30) { + return OPJ_FALSE; + } passtype = 2; opj_mqc_resetstates(mqc); |