summaryrefslogtreecommitdiff
path: root/third_party/libopenjpeg20/tcd.c
diff options
context:
space:
mode:
authorochang <ochang@chromium.org>2016-07-25 15:09:34 -0700
committerCommit bot <commit-bot@chromium.org>2016-07-25 15:09:34 -0700
commitd8cc503575463ff3d81b22dad292665f2c88911e (patch)
treea6f1df9bb80ceeccc778c5ed186d9e4868b99506 /third_party/libopenjpeg20/tcd.c
parent22b05fc0f0cbfd3841b0963b577719fd16725081 (diff)
downloadpdfium-d8cc503575463ff3d81b22dad292665f2c88911e.tar.xz
Fix an integer overflow in opj_tcd_get_decoded_tile_size().chromium/2810chromium/2809
Based on suggested patch by reporter. BUG=629919 Review-Url: https://codereview.chromium.org/2182683002
Diffstat (limited to 'third_party/libopenjpeg20/tcd.c')
-rw-r--r--third_party/libopenjpeg20/tcd.c16
1 files changed, 14 insertions, 2 deletions
diff --git a/third_party/libopenjpeg20/tcd.c b/third_party/libopenjpeg20/tcd.c
index 673633c09b..cd1c43921d 100644
--- a/third_party/libopenjpeg20/tcd.c
+++ b/third_party/libopenjpeg20/tcd.c
@@ -1150,6 +1150,7 @@ OPJ_UINT32 opj_tcd_get_decoded_tile_size ( opj_tcd_t *p_tcd )
opj_tcd_tilecomp_t * l_tile_comp = 00;
opj_tcd_resolution_t * l_res = 00;
OPJ_UINT32 l_size_comp, l_remaining;
+ OPJ_UINT32 l_temp;
l_tile_comp = p_tcd->tcd_image->tiles->comps;
l_img_comp = p_tcd->image->comps;
@@ -1167,7 +1168,18 @@ OPJ_UINT32 opj_tcd_get_decoded_tile_size ( opj_tcd_t *p_tcd )
}
l_res = l_tile_comp->resolutions + l_tile_comp->minimum_num_resolutions - 1;
- l_data_size += l_size_comp * (OPJ_UINT32)((l_res->x1 - l_res->x0) * (l_res->y1 - l_res->y0));
+ l_temp = (OPJ_UINT32)((l_res->x1 - l_res->x0) * (l_res->y1 - l_res->y0)); /* x1*y1 can't overflow */
+
+ if (l_size_comp && ((OPJ_UINT32)-1) / l_size_comp < l_temp) {
+ return (OPJ_UINT32)-1;
+ }
+ l_temp *= l_size_comp;
+
+ if (l_temp > ((OPJ_UINT32)-1) - l_data_size) {
+ return (OPJ_UINT32)-1;
+ }
+ l_data_size += l_temp;
+
++l_img_comp;
++l_tile_comp;
}
@@ -1362,7 +1374,7 @@ OPJ_BOOL opj_tcd_update_tile_data ( opj_tcd_t *p_tcd,
OPJ_UINT32 l_stride, l_width,l_height;
l_data_size = opj_tcd_get_decoded_tile_size(p_tcd);
- if (l_data_size > p_dest_length) {
+ if (l_data_size == (OPJ_UINT32)-1 || l_data_size > p_dest_length) {
return OPJ_FALSE;
}