summaryrefslogtreecommitdiff
path: root/core/fxcodec
AgeCommit message (Collapse)Author
2018-02-15Correctly seek when header size is larger then expectedchromium/3349Ryan Harrison
BUG=chromium:811733 Change-Id: Idce50b8ea4ca06fc77d5b3931557cd1d6fe48bd5 Reviewed-on: https://pdfium-review.googlesource.com/26710 Reviewed-by: Tom Sepez <tsepez@chromium.org> Reviewed-by: Henrique Nakashima <hnakashima@chromium.org> Commit-Queue: Ryan Harrison <rharrison@chromium.org>
2018-02-14Check that the request was satisfied in ReadDataRyan Harrison
Currently the BMP decompressor doesn't verify the returned data length was the amount requested. This means we may end up with part of our structure uninitialized if we didn't copy in enough data. This CL verifies the length of data copied is the size we require. BUG=chromium:811853 Change-Id: I20e0e9b3ff1176a620fcb38c3c7e585848b7e428 Reviewed-on: https://pdfium-review.googlesource.com/26850 Commit-Queue: Ryan Harrison <rharrison@chromium.org> Reviewed-by: dsinclair <dsinclair@chromium.org>
2018-02-13Change return value of GetAvailInputRyan Harrison
This changes the return value from uint32_t to FX_FILESIZE, which is the type the methods is uses return. The existing code does an unguarded static cast, so something like -1 could cause a very large value being returned. This change has a cascading impact up to the top of the progressive codec, which now has to handle negative values gracefully. Change-Id: I813fb71e932dd5da014dbaed0dbf3bb28f8d4e9f Reviewed-on: https://pdfium-review.googlesource.com/26450 Commit-Queue: Ryan Harrison <rharrison@chromium.org> Reviewed-by: Lei Zhang <thestig@chromium.org>
2018-02-12Fix signedness in CJBig2_HuffmanTable, and add overflow checkNicolas Pena
Bug: 808902 Change-Id: Iad5ab63eeedc3ea85001337ba73626178c71f8b8 Reviewed-on: https://pdfium-review.googlesource.com/26470 Reviewed-by: Tom Sepez <tsepez@chromium.org> Commit-Queue: Nicolás Peña Moreno <npm@chromium.org>
2018-02-12Convert CFX_BmpDecompressor to use CFX_MemoryStreamRyan Harrison
This also adds a Seek method to CFX_MemoryStream BUG=pdfium:1007 Change-Id: I2c7e1d3b6d8aff36e302014cb2e8ffc0f23ef7c4 Reviewed-on: https://pdfium-review.googlesource.com/26230 Commit-Queue: Ryan Harrison <rharrison@chromium.org> Reviewed-by: Lei Zhang <thestig@chromium.org>
2018-02-07Remove some deprecated RenderPage method usage.Lei Zhang
Do some additional checks in test cases where pages were rendered but the resulting bitmap was immediately destroyed. Change-Id: I2f4678140cdc672ab4ced70f748135464447ff59 Reviewed-on: https://pdfium-review.googlesource.com/25510 Reviewed-by: dsinclair <dsinclair@chromium.org> Commit-Queue: Lei Zhang <thestig@chromium.org>
2018-02-07Clean up RenderPage methods in EmbedderTest.Lei Zhang
Add replacement methods that make themselves clear as to what they are rendering, and return unique_ptrs to help prevent leakage. Mark existing methods deprecated. Change-Id: I9055407e614dfbe765428fb32a7da64df3418d1d Reviewed-on: https://pdfium-review.googlesource.com/25470 Reviewed-by: dsinclair <dsinclair@chromium.org> Commit-Queue: Lei Zhang <thestig@chromium.org>
2018-02-07Check that request sizes in ReadData don't overflowRyan Harrison
When a very large, bogus value, was being passed in for the number of bytes to read, this could cause an overflow in the check for if there is data available. BUG=chromium:809824 Change-Id: I54af6655b61d39275f3ae6fabb27be2bee3fef05 Reviewed-on: https://pdfium-review.googlesource.com/25871 Reviewed-by: dsinclair <dsinclair@chromium.org> Commit-Queue: Ryan Harrison <rharrison@chromium.org>
2018-02-06Break unneeded dep on Bmp codec in Gif codecRyan Harrison
BUG=pdfium:1006 Change-Id: I84d2a13ac7b24e7f2f5cba8765d6433860241b58 Reviewed-on: https://pdfium-review.googlesource.com/25710 Reviewed-by: Henrique Nakashima <hnakashima@chromium.org> Commit-Queue: Ryan Harrison <rharrison@chromium.org>
2018-02-06Account for skip size before getting image ifh sizeRyan Harrison
BUG=chromium:808336 Change-Id: I84443a00e2ebaf0a1e8590464486ec92bcb0e3b5 Reviewed-on: https://pdfium-review.googlesource.com/25690 Reviewed-by: Henrique Nakashima <hnakashima@chromium.org> Commit-Queue: Ryan Harrison <rharrison@chromium.org>
2018-02-06Extract classes in fx_bmp.h into their own filesRyan Harrison
BUG=chromium:808336 Change-Id: I3201805a374b5403149eca701714ef4369a2e337 Reviewed-on: https://pdfium-review.googlesource.com/25630 Reviewed-by: Henrique Nakashima <hnakashima@chromium.org> Commit-Queue: Ryan Harrison <rharrison@chromium.org>
2018-02-06Convert BMP class name style to match other codecsRyan Harrison
BMPDecompressor -> CFX_BmpDecompressor CBmpContext -> CFX_BmpContext BUG=chromium:808336 Change-Id: If8ef5294171e3619ae1d7c5175ddf23b7673ec78 Reviewed-on: https://pdfium-review.googlesource.com/25611 Reviewed-by: Henrique Nakashima <hnakashima@chromium.org> Commit-Queue: Ryan Harrison <rharrison@chromium.org>
2018-02-06Move core/fxcodec/lbmp/ -> core/fxcodec/bmp/Ryan Harrison
BUG=chromium:808336 Change-Id: Id721787dd77d1bcac6daf6e3c149f79e8d1d9fe4 Reviewed-on: https://pdfium-review.googlesource.com/25610 Reviewed-by: dsinclair <dsinclair@chromium.org> Commit-Queue: Ryan Harrison <rharrison@chromium.org>
2018-02-06Changing the member naming style in BMPDecompressorRyan Harrison
Currently there is no indication in the name of it being a member variable and the capitalization is inconsistent. This CL brings them all into line with Chromium style. BUG=chromium:808336 Change-Id: Iaed0272b69350f316371a67eb513934a0169f451 Reviewed-on: https://pdfium-review.googlesource.com/25430 Reviewed-by: Henrique Nakashima <hnakashima@chromium.org> Commit-Queue: Ryan Harrison <rharrison@chromium.org>
2018-02-05Limit dest buffer to 1GB in FlateOrLZWDecode.Henrique Nakashima
Bug: chromium:802094 Change-Id: I99d2d75cd431afe1cdb966e1431143ab43dd9a73 Reviewed-on: https://pdfium-review.googlesource.com/24730 Reviewed-by: Tom Sepez <tsepez@chromium.org> Commit-Queue: Henrique Nakashima <hnakashima@chromium.org>
2018-01-30Check if opj_image_data_alloc returned null.Henrique Nakashima
Bug: chromium:797726 Change-Id: Ib13d5a4a78de462f1257f1103728f2a4111cb916 Reviewed-on: https://pdfium-review.googlesource.com/24510 Reviewed-by: Ryan Harrison <rharrison@chromium.org> Commit-Queue: Henrique Nakashima <hnakashima@chromium.org>
2018-01-30Revert "Revert "Use UnownedPtr instead of T* in MaybeOwned.""Tom Sepez
This reverts commit 77d8ed02c7e97471ceccee5abbabeb2fdea413c7. Reason for revert: <INSERT REASONING HERE> Original change's description: > Revert "Use UnownedPtr instead of T* in MaybeOwned." > > This reverts commit e563e8352139e4852a955e319023b09f2844aee9. > > Reason for revert: <INSERT REASONING HERE> > > Original change's description: > > Use UnownedPtr instead of T* in MaybeOwned. > > > > Always check the liftime in the unowned case. Doing so unearthed > > the following issues: > > > > Transient lifetime issue in jbig2_image when doing realloc(). > > Stale (but unused) dictionary pointer in CPDF_Image. > > Destruction order in error branch in cpdf_dibsource.cpp > > > > Change-Id: I12b758aafeefedc7abe1e8b21a18db959929e95f > > Reviewed-on: https://pdfium-review.googlesource.com/24552 > > Commit-Queue: Tom Sepez <tsepez@chromium.org> > > Reviewed-by: dsinclair <dsinclair@chromium.org> > > TBR=thestig@chromium.org,tsepez@chromium.org,dsinclair@chromium.org > > Change-Id: I3c56ee6ab502da90e3adb7507dbc8cc92f090140 > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Reviewed-on: https://pdfium-review.googlesource.com/24670 > Reviewed-by: Tom Sepez <tsepez@chromium.org> > Commit-Queue: Tom Sepez <tsepez@chromium.org> TBR=thestig@chromium.org,tsepez@chromium.org,dsinclair@chromium.org Change-Id: I0ccbbeab8be6cadc9b3a5bfefe2aca733654342f No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://pdfium-review.googlesource.com/24671 Reviewed-by: Tom Sepez <tsepez@chromium.org> Commit-Queue: Tom Sepez <tsepez@chromium.org>
2018-01-30Revert "Use UnownedPtr instead of T* in MaybeOwned."Tom Sepez
This reverts commit e563e8352139e4852a955e319023b09f2844aee9. Reason for revert: <INSERT REASONING HERE> Original change's description: > Use UnownedPtr instead of T* in MaybeOwned. > > Always check the liftime in the unowned case. Doing so unearthed > the following issues: > > Transient lifetime issue in jbig2_image when doing realloc(). > Stale (but unused) dictionary pointer in CPDF_Image. > Destruction order in error branch in cpdf_dibsource.cpp > > Change-Id: I12b758aafeefedc7abe1e8b21a18db959929e95f > Reviewed-on: https://pdfium-review.googlesource.com/24552 > Commit-Queue: Tom Sepez <tsepez@chromium.org> > Reviewed-by: dsinclair <dsinclair@chromium.org> TBR=thestig@chromium.org,tsepez@chromium.org,dsinclair@chromium.org Change-Id: I3c56ee6ab502da90e3adb7507dbc8cc92f090140 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://pdfium-review.googlesource.com/24670 Reviewed-by: Tom Sepez <tsepez@chromium.org> Commit-Queue: Tom Sepez <tsepez@chromium.org>
2018-01-30Use UnownedPtr instead of T* in MaybeOwned.Tom Sepez
Always check the liftime in the unowned case. Doing so unearthed the following issues: Transient lifetime issue in jbig2_image when doing realloc(). Stale (but unused) dictionary pointer in CPDF_Image. Destruction order in error branch in cpdf_dibsource.cpp Change-Id: I12b758aafeefedc7abe1e8b21a18db959929e95f Reviewed-on: https://pdfium-review.googlesource.com/24552 Commit-Queue: Tom Sepez <tsepez@chromium.org> Reviewed-by: dsinclair <dsinclair@chromium.org>
2018-01-29Remove duplicate assignments in sycc420_to_rgb().Lei Zhang
BUG=chromium:805881 Change-Id: I3b4914325833c859285a4af1f6e326872cbf1b18 Reviewed-on: https://pdfium-review.googlesource.com/24091 Commit-Queue: dsinclair <dsinclair@chromium.org> Reviewed-by: dsinclair <dsinclair@chromium.org>
2018-01-26Fix potential memory leak in CCodec_JpegModule::Start().Lei Zhang
BUG=chromium:805881 Change-Id: I91266367296218998d011dd5f62e0b4c6df291a3 Reviewed-on: https://pdfium-review.googlesource.com/24070 Commit-Queue: Ryan Harrison <rharrison@chromium.org> Reviewed-by: Ryan Harrison <rharrison@chromium.org>
2018-01-19Remove code added in by a bad rebase or mergechromium/3328chromium/3327chromium/3326Ryan Harrison
The guard being removed was moved lower down in the code, but it appears the original creeped back in while I was rebasing at some point. This is causing clusterfuzz failures. BUG=chromium:803732,chromium:803735 Change-Id: I5bcc6046e64d6060a674f390e243dd8eda9d1d17 Reviewed-on: https://pdfium-review.googlesource.com/23250 Reviewed-by: Henrique Nakashima <hnakashima@chromium.org> Commit-Queue: Ryan Harrison <rharrison@chromium.org>
2018-01-18Avoid integer overflows in CJBig2_Image::composeTo_opt2().Lei Zhang
BUG=chromium:802983 Change-Id: I866ece9c370bf05571b76b50ad23598f5038332b Reviewed-on: https://pdfium-review.googlesource.com/23151 Reviewed-by: Tom Sepez <tsepez@chromium.org> Commit-Queue: Lei Zhang <thestig@chromium.org>
2018-01-18Declare variables closer to use in CJBig2_Image::composeTo_opt2().Lei Zhang
Change-Id: Ifabaf71bb45ffa7e9af7da4acb21d8757e9596ce Reviewed-on: https://pdfium-review.googlesource.com/23150 Reviewed-by: Ryan Harrison <rharrison@chromium.org> Commit-Queue: Lei Zhang <thestig@chromium.org>
2018-01-18Move format specific elements out of ContinueDecodeRyan Harrison
Refactoring the big image format switch in ContinueDecode to call separate methods for each image format, instead of having one giant switch block. This should have no functional changes. BUG=pdfium:976 Change-Id: Ide4892526ee823023c233f0e43b1c98ac8bd1477 Reviewed-on: https://pdfium-review.googlesource.com/23134 Reviewed-by: dsinclair <dsinclair@chromium.org> Commit-Queue: Ryan Harrison <rharrison@chromium.org>
2018-01-17Move format specific elements out of StartDecodechromium/3324Ryan Harrison
Refactoring the big image format switch in StartDecode to call separate methods for each image format, instead of having one giant switch block. This should have no functional changes. BUG=pdfium:976 Change-Id: I4e609ecaec0c5d0e173957c0795555b37c38f9a2 Reviewed-on: https://pdfium-review.googlesource.com/23131 Commit-Queue: Ryan Harrison <rharrison@chromium.org> Reviewed-by: dsinclair <dsinclair@chromium.org>
2018-01-17Move format specific elements out of DetectImageTypeRyan Harrison
Refactoring the big image format switch in DetectImageType to call separate methods for each image format, instead of having one giant switch block. This should have no functional changes. BUG=pdfium:976 Change-Id: I52cc83879da20b33d471420016f6b1eb53993f0b Reviewed-on: https://pdfium-review.googlesource.com/23130 Commit-Queue: Ryan Harrison <rharrison@chromium.org> Reviewed-by: dsinclair <dsinclair@chromium.org>
2018-01-17Remove param checking from StartScanLineRyan Harrison
By catching this early we are now actually returning the wrong value. The bad value should be passed into the jpeg library code, which will cause a fatal error and jump out to the common error handling code for this method. BUG=pdfium:986 Change-Id: Ib3d32939aa38aece887c014c3a477407ee178193 Reviewed-on: https://pdfium-review.googlesource.com/23119 Commit-Queue: Ryan Harrison <rharrison@chromium.org> Reviewed-by: dsinclair <dsinclair@chromium.org>
2018-01-17Move remaining jpeg error handling up a levelRyan Harrison
This moves the setjmps needed for handling fatal errors in the jpeg library up a level to be in line with how other instances of this are being modified. This additionally reduces the number of times that setjmp needs to be called and documents why it is occurring. This covers the Start and ReadScanLine methods. It also adds in setting the error member, which had been missed in previous CLs. BUG=pdfium:986 Change-Id: I7db87288ffe0ee8b29899d97035c30ad812da76a Reviewed-on: https://pdfium-review.googlesource.com/23117 Reviewed-by: dsinclair <dsinclair@chromium.org> Commit-Queue: Ryan Harrison <rharrison@chromium.org>
2018-01-17Move jpeg header read error handling up a levelRyan Harrison
This move the setjmp needed for handling fatal errors in the jpeg library up a level to be in line with how other instances of this are being modified. This additionally reduces the number of times that setjmp needs to be called and documents why it is occuring. BUG=pdfium:986 Change-Id: Ia57821e1ce65aae811618effb3f2fa6256e1ab8c Reviewed-on: https://pdfium-review.googlesource.com/23115 Reviewed-by: dsinclair <dsinclair@chromium.org> Commit-Queue: Ryan Harrison <rharrison@chromium.org>
2018-01-17Correctly handle errors when starting jpeg codecRyan Harrison
The current implementation treats both returning false and longjmp'ing out of jpeg_start_decompress as indicating that the decompression has paused and needs more data. This is incorrect, in reality only the false return value indicates this. The longjmp path indicates a fatal error in the processing of the jpeg. The default implementation actually calls exit() in this case, and the documentation explicitly calls out that in this case recovery isn't possible and the decode process will have to start from scratch. This resolves a situation where the progressive decoder would get a malformed jpeg and keep on grabbing blocks from it and try to start decoding it. This would eventually fail when it ran out of data to read, but would cause a large memory leak and a crash on the MSAN fuzzers. BUG=pdfium:986,chromium:798665 Change-Id: Ifd2ed7a2dc46fa20bab34e9c461a8d4c4718c4d7 Reviewed-on: https://pdfium-review.googlesource.com/23072 Reviewed-by: dsinclair <dsinclair@chromium.org> Commit-Queue: Ryan Harrison <rharrison@chromium.org>
2018-01-15Revert "Check for success of decodes to avoid infinite loops"Nicolás Peña Moreno
This reverts commit dca380ffe0571be4023b11b06b8aecad9934bb06. Reason for revert: Causes missing text in a user's PDF Original change's description: > Check for success of decodes to avoid infinite loops > > Bug: 790693 > Change-Id: I9b1d87e024229d8b01f55ec554e2cc544db6ac06 > Reviewed-on: https://pdfium-review.googlesource.com/20230 > Reviewed-by: Henrique Nakashima <hnakashima@chromium.org> > Commit-Queue: Nicolás Peña Moreno <npm@chromium.org> TBR=npm@chromium.org,hnakashima@chromium.org,rharrison@chromium.org # Not skipping CQ checks because original CL landed > 1 day ago. Bug: 790693 Change-Id: I886b14e120c34da757a96f8a1f9c6a081d8326b6 Reviewed-on: https://pdfium-review.googlesource.com/22950 Reviewed-by: Nicolás Peña Moreno <npm@chromium.org> Commit-Queue: Nicolás Peña Moreno <npm@chromium.org>
2017-12-19Remove some dead code.Lei Zhang
Change-Id: I8edb14c024860c66b5e6c014136393e71e38387d Reviewed-on: https://pdfium-review.googlesource.com/21570 Reviewed-by: Henrique Nakashima <hnakashima@chromium.org> Commit-Queue: Lei Zhang <thestig@chromium.org>
2017-12-11Remove default arguments to CPDF_StreamAcc::LoadAllData().Lei Zhang
Add LoadAllDataFiltered() and LoadAllDataRaw() and update callers. Change-Id: I9b80ee34a358db204968acdc8b1adc9db0b6b83f Reviewed-on: https://pdfium-review.googlesource.com/20810 Commit-Queue: Lei Zhang <thestig@chromium.org> Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
2017-12-01Get rid of else after break/continue/return.chromium/3284chromium/3283Lei Zhang
Change-Id: I3efc57cd7325d16e3ca8ebdeeaec06012b2c56e3 Reviewed-on: https://pdfium-review.googlesource.com/20110 Reviewed-by: Henrique Nakashima <hnakashima@chromium.org> Commit-Queue: Lei Zhang <thestig@chromium.org>
2017-12-01Check for success of decodes to avoid infinite loopsNicolas Pena
Bug: 790693 Change-Id: I9b1d87e024229d8b01f55ec554e2cc544db6ac06 Reviewed-on: https://pdfium-review.googlesource.com/20230 Reviewed-by: Henrique Nakashima <hnakashima@chromium.org> Commit-Queue: Nicolás Peña Moreno <npm@chromium.org>
2017-11-30Prevent integer overflow in CJBig2_HuffmanTable::ParseFromCodedBufferNicolas Pena
In this CL we prevent integer overflow by checking that the integers are in the appropriate range before casting from unsigned to signed. Bug: 789524 Change-Id: I41572849f18ffb0f0739c80130ee6b5061845d29 Reviewed-on: https://pdfium-review.googlesource.com/20011 Reviewed-by: dsinclair <dsinclair@chromium.org> Commit-Queue: Nicolás Peña Moreno <npm@chromium.org>
2017-11-29Allow building pdfium against the system version of libpng.Andrew Weintraub
Bug: Change-Id: I0c930ca30637f58af3b60ed8f1383bd9234a1723 Reviewed-on: https://pdfium-review.googlesource.com/19850 Commit-Queue: Lei Zhang <thestig@chromium.org> Reviewed-by: Lei Zhang <thestig@chromium.org>
2017-11-28Remove CollectionSize from JBig2_ContextDan Sinclair
Bug: pdfium:774 Change-Id: Ie7674ac55dea6284a0d974cef107ef357197a06b Reviewed-on: https://pdfium-review.googlesource.com/19610 Commit-Queue: dsinclair <dsinclair@chromium.org> Reviewed-by: Ryan Harrison <rharrison@chromium.org>
2017-11-27Convert CFX_GifContext::GetFrameNum to size_tDan Sinclair
This CL removes the CollectionSize and updates call locations as needed. Bug: pdfium:774 Change-Id: I813c500b3a17a194407ceb1304252b9b16fe1779 Reviewed-on: https://pdfium-review.googlesource.com/19590 Commit-Queue: dsinclair <dsinclair@chromium.org> Reviewed-by: Ryan Harrison <rharrison@chromium.org>
2017-11-21Avoid passing pointers by reference in core.Lei Zhang
This gets rid of most core/ non-const ref passing, either by passing by pointer-to-pointer instead, or by returning std::pair. Change-Id: Id7bdc355a1a725a05f9fa2f1e982ca8c975beef1 Reviewed-on: https://pdfium-review.googlesource.com/19030 Commit-Queue: Lei Zhang <thestig@chromium.org> Reviewed-by: dsinclair <dsinclair@chromium.org>
2017-11-10Check for decoder completeness in CJBig2_GRRDProcNicolas Pena
This CL adds checks in CJBig2_GRRDProc to verify if the decoder is completed before trying to decode. This is currently done in all decoding calls in CJBig2_GRDProc. Bug: chromium:782826 Change-Id: Ifb4ee4d09e8357e969aefa107b4dafbc2284324b Reviewed-on: https://pdfium-review.googlesource.com/18333 Reviewed-by: Lei Zhang <thestig@chromium.org> Commit-Queue: Nicolás Peña Moreno <npm@chromium.org>
2017-11-09Rename some methods in CJBig2_Contextchromium/3264Nicolas Pena
This CL improves some method names and does other basic cleanup. Change-Id: I32ea88ff29383e9685d4c686625088c96f73f035 Reviewed-on: https://pdfium-review.googlesource.com/18210 Reviewed-by: Ryan Harrison <rharrison@chromium.org> Commit-Queue: Nicolás Peña Moreno <npm@chromium.org>
2017-11-08Prevent cyclic offset on CJBig2_ContextNicolas Pena
This CL changes the type of |m_dwOffset| to safe unsigned integer to prevent the offset from cycling from MAX_UINT32 back to 0. Bug: chromium:778912 Change-Id: Ib93a8392e52eecf2cc223438ac85e9dc529b0f43 Reviewed-on: https://pdfium-review.googlesource.com/18130 Reviewed-by: Tom Sepez <tsepez@chromium.org> Commit-Queue: Nicolás Peña Moreno <npm@chromium.org>
2017-11-07Use MaybeOwned in CJBig2_ImageNicolas Pena
Change-Id: Id53cbb8c95f6eb929f6e4eb57333daa24f1b776f Reviewed-on: https://pdfium-review.googlesource.com/18010 Reviewed-by: Tom Sepez <tsepez@chromium.org> Commit-Queue: Nicolás Peña Moreno <npm@chromium.org>
2017-11-07More FX_SAFE_INT32 in CJBig2_TRDProcNicolas Pena
Bug: chromium:781780 Change-Id: Ie92d8b570c37e9b3364d1ff4502f444a275ee6c2 Reviewed-on: https://pdfium-review.googlesource.com/17910 Commit-Queue: dsinclair <dsinclair@chromium.org> Reviewed-by: dsinclair <dsinclair@chromium.org>
2017-11-03Remove flags param from FXMEM_DefaultAlloc() and friends.Lei Zhang
Change-Id: I24404be0065156a1cfdec31bafdf72c27fa70142 Reviewed-on: https://pdfium-review.googlesource.com/17792 Reviewed-by: Chris Palmer <palmer@chromium.org> Commit-Queue: Lei Zhang <thestig@chromium.org>
2017-11-03Check for NULL pointer in _TIFFfree().chromium/3258Lei Zhang
PartitionAlloc does not handle free(NULL), so _TIFFfree() needs to do the check, just like png_free_default() and _cmsFree() for other third party code. BUG=chromium:780709 Change-Id: I4e2ff0ba642c66e4a73e151c9ab42ebb42d34a5b Reviewed-on: https://pdfium-review.googlesource.com/17791 Reviewed-by: Chris Palmer <palmer@chromium.org> Commit-Queue: Lei Zhang <thestig@chromium.org>
2017-10-30More safe ints in CJBig2_TRDProcNicolas Pena
Bug: chromium:778961 Change-Id: I1d08b3282304931276c24e50392c10b21780dcde Reviewed-on: https://pdfium-review.googlesource.com/16971 Commit-Queue: dsinclair <dsinclair@chromium.org> Reviewed-by: Tom Sepez <tsepez@chromium.org> Reviewed-by: dsinclair <dsinclair@chromium.org>
2017-10-25Enforce end of data in CJBig2_ArithDecoderNicolas Pena
Quoting the JBIG2 spec: "If B is a 0xFF byte, then B1 (the byte pointed to by BP+1) is tested. If B1 exceeds 0x8F, then B1 must be one of the marker codes. The marker code is interpreted as required, and the buffer pointer remains pointed to the 0xFF prefix of the marker code which terminates the arithmetically compressed data. 1-bits are then fed to the decoder until the decoding is complete. This is shown by adding 0xFF00 to the C-register and setting the bit counter CT to 8." Our implementation is the alternative (faster for software according to the spec), where only CT is changed to 8. Reaching this part of the code means we will never read from stream again so we should be wrapping up the decoding. To ensure this, the |m_Complete| attribute is set to true if we reach this code again, which will result in bailing out next time DECODE is called. Bug: 767156 Change-Id: I434d46bc7914713a065f0e4da079bbc9b5dd216c Reviewed-on: https://pdfium-review.googlesource.com/16791 Reviewed-by: dsinclair <dsinclair@chromium.org> Commit-Queue: Nicolás Peña Moreno <npm@chromium.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 02:19:58 +0000