summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--core/src/fpdfapi/fpdf_page/fpdf_page_func.cpp25
-rw-r--r--fpdfsdk/src/fpdfview_embeddertest.cpp9
-rw-r--r--testing/resources/bug_471990.in56
-rw-r--r--testing/resources/bug_471990.pdf90
4 files changed, 170 insertions, 10 deletions
diff --git a/core/src/fpdfapi/fpdf_page/fpdf_page_func.cpp b/core/src/fpdfapi/fpdf_page/fpdf_page_func.cpp
index f115b6770d..e691f3ab10 100644
--- a/core/src/fpdfapi/fpdf_page/fpdf_page_func.cpp
+++ b/core/src/fpdfapi/fpdf_page/fpdf_page_func.cpp
@@ -449,7 +449,8 @@ public:
virtual FX_BOOL v_Call(FX_FLOAT* inputs, FX_FLOAT* results) const;
SampleEncodeInfo* m_pEncodeInfo;
SampleDecodeInfo* m_pDecodeInfo;
- FX_DWORD m_nBitsPerSample, m_SampleMax;
+ FX_DWORD m_nBitsPerSample;
+ FX_DWORD m_SampleMax;
CPDF_StreamAcc* m_pSampleStream;
};
CPDF_SampledFunc::CPDF_SampledFunc()
@@ -479,6 +480,9 @@ FX_BOOL CPDF_SampledFunc::v_Init(CPDF_Object* pObj)
CPDF_Array* pEncode = pDict->GetArray(FX_BSTRC("Encode"));
CPDF_Array* pDecode = pDict->GetArray(FX_BSTRC("Decode"));
m_nBitsPerSample = pDict->GetInteger(FX_BSTRC("BitsPerSample"));
+ if (m_nBitsPerSample > 32) {
+ return FALSE;
+ }
m_SampleMax = 0xffffffff >> (32 - m_nBitsPerSample);
m_pSampleStream = new CPDF_StreamAcc;
m_pSampleStream->LoadAllData(pStream, FALSE);
@@ -553,20 +557,23 @@ FX_BOOL CPDF_SampledFunc::v_Call(FX_FLOAT* inputs, FX_FLOAT* results) const
}
pos += index[i] * blocksize[i];
}
+ FX_SAFE_INT32 bits_to_output = m_nOutputs;
+ bits_to_output *= m_nBitsPerSample;
+ if (!bits_to_output.IsValid()) {
+ return FALSE;
+ }
FX_SAFE_INT32 bitpos = pos;
- bitpos *= m_nBitsPerSample;
- bitpos *= m_nOutputs;
+ bitpos *= bits_to_output.ValueOrDie();
if (!bitpos.IsValid()) {
return FALSE;
}
- const uint8_t* pSampleData = m_pSampleStream->GetData();
- if (pSampleData == NULL) {
+ FX_SAFE_INT32 range_check = bitpos;
+ range_check += bits_to_output.ValueOrDie();
+ if (!range_check.IsValid()) {
return FALSE;
}
- FX_SAFE_INT32 bitpos1 = m_nOutputs - 1 > 0 ? m_nOutputs - 1 : 0;
- bitpos1 *= m_nBitsPerSample;
- bitpos1 += bitpos.ValueOrDie();
- if (!bitpos1.IsValid()) {
+ const uint8_t* pSampleData = m_pSampleStream->GetData();
+ if (!pSampleData) {
return FALSE;
}
for (int j = 0; j < m_nOutputs; j ++) {
diff --git a/fpdfsdk/src/fpdfview_embeddertest.cpp b/fpdfsdk/src/fpdfview_embeddertest.cpp
index cc0aa1f818..60c14b3edb 100644
--- a/fpdfsdk/src/fpdfview_embeddertest.cpp
+++ b/fpdfsdk/src/fpdfview_embeddertest.cpp
@@ -197,6 +197,13 @@ TEST_F(FPDFViewEmbeddertest, Crasher_452455) {
UnloadPage(page);
}
-TEST_F(FPDFViewEmbeddertest, Crasher3) {
+TEST_F(FPDFViewEmbeddertest, Crasher_454695) {
EXPECT_TRUE(OpenDocument("testing/resources/bug_454695.pdf"));
}
+
+TEST_F(FPDFViewEmbeddertest, Crasher_471990) {
+ EXPECT_TRUE(OpenDocument("testing/resources/bug_471990.pdf"));
+ FPDF_PAGE page = LoadPage(0);
+ EXPECT_NE(nullptr, page);
+ UnloadPage(page);
+}
diff --git a/testing/resources/bug_471990.in b/testing/resources/bug_471990.in
new file mode 100644
index 0000000000..7425405d27
--- /dev/null
+++ b/testing/resources/bug_471990.in
@@ -0,0 +1,56 @@
+{{header}}
+{{object 1 0}} <<
+ /Type /Catalog
+ /Pages 2 0 R
+>>
+endobj
+{{object 2 0}} <<
+ /Type /Pages
+ /Kids [10 0 R]
+ /Count 1
+>>
+{{object 10 0}} <<
+ /Type /Page
+ /Parent 2 0 R
+ /Resources <<
+ /ColorSpace <<
+ /cs1 20 0 R
+ >>
+ >>
+ /Contents 30 0 R
+ /MediaBox [0 0 842 1191]
+ /CropBox [123.307 198.425 718.693 992.575]
+>>
+endobj
+{{object 20 0}} [
+ /Separation /All
+ /DeviceCMYK 21 0 R
+]
+endobj
+{{object 21 0}} <<
+ /FunctionType 0
+ /BitsPerSample 536870910
+ /Range [0 1 0 1 0 1 0 1]
+ /Decode [0 1 0 1 0 1 0 1]
+ /Length 1073741823
+ /Encode [0 1]
+ /Domain [0 1]
+ /Size [2]
+>>
+stream
+endstream
+endobj
+{{object 30 0}} <<
+>>
+stream
+/cs1 cs
+0 scn
+endstream
+endobj
+{{xref}}
+trailer <<
+ /Root 1 0 R
+ /Size 30
+>>
+{{startxref}}
+%%EOF
diff --git a/testing/resources/bug_471990.pdf b/testing/resources/bug_471990.pdf
new file mode 100644
index 0000000000..8d8a3e22c0
--- /dev/null
+++ b/testing/resources/bug_471990.pdf
@@ -0,0 +1,90 @@
+%PDF-1.7
+% ò¤ô
+1 0 obj <<
+ /Type /Catalog
+ /Pages 2 0 R
+>>
+endobj
+2 0 obj <<
+ /Type /Pages
+ /Kids [10 0 R]
+ /Count 1
+>>
+10 0 obj <<
+ /Type /Page
+ /Parent 2 0 R
+ /Resources <<
+ /ColorSpace <<
+ /cs1 20 0 R
+ >>
+ >>
+ /Contents 30 0 R
+ /MediaBox [0 0 842 1191]
+ /CropBox [123.307 198.425 718.693 992.575]
+>>
+endobj
+20 0 obj [
+ /Separation /All
+ /DeviceCMYK 21 0 R
+]
+endobj
+21 0 obj <<
+ /FunctionType 0
+ /BitsPerSample 536870910
+ /Range [0 1 0 1 0 1 0 1]
+ /Decode [0 1 0 1 0 1 0 1]
+ /Length 1073741823
+ /Encode [0 1]
+ /Domain [0 1]
+ /Size [2]
+>>
+stream
+endstream
+endobj
+30 0 obj <<
+>>
+stream
+/cs1 cs
+0 scn
+endstream
+endobj
+xref
+0 31
+0000000000 65535 f
+0000000015 00000 n
+0000000068 00000 n
+0000000000 65535 f
+0000000000 65535 f
+0000000000 65535 f
+0000000000 65535 f
+0000000000 65535 f
+0000000000 65535 f
+0000000000 65535 f
+0000000125 00000 n
+0000000000 65535 f
+0000000000 65535 f
+0000000000 65535 f
+0000000000 65535 f
+0000000000 65535 f
+0000000000 65535 f
+0000000000 65535 f
+0000000000 65535 f
+0000000000 65535 f
+0000000333 00000 n
+0000000393 00000 n
+0000000000 65535 f
+0000000000 65535 f
+0000000000 65535 f
+0000000000 65535 f
+0000000000 65535 f
+0000000000 65535 f
+0000000000 65535 f
+0000000000 65535 f
+0000000597 00000 n
+trailer <<
+ /Root 1 0 R
+ /Size 30
+>>
+startxref
+650
+%%EOF