Age | Commit message (Collapse) | Author |
|
This avoids unchecked multiplications when computing a size argument
to malloc(). Such an overflow is very scary, and can result in
exploitable bugs.
Along the way, kill off some return checks, since we know this can't
return NULL.
R=thestig@chromium.org
Review URL: https://codereview.chromium.org/1143663004
|
|
Failure to check document-controlled value before using it.
BUG=481363
R=palmer@chromium.org, thestig@chromium.org
Review URL: https://codereview.chromium.org/1110653002
|
|
Very few places where a change is required, but remove FX_NEW to show
they've been audited.
R=thestig@chromium.org
Review URL: https://codereview.chromium.org/1075953004
|
|
space is used"
This reverts commit 5a0e504d53195892458d819e52c62bea0c710bd5.
Original review URL https://codereview.chromium.org/1009513003
Reason for revert: New "corpus" tests show that this is no longer rendering some images. See, e.g. http://chromegw/i/client.pdfium/builders/linux/builds/144/steps/corpus%20tests/logs/stdio for those that diff'd.
TBR=jun_fang@foxitsoftware.com
Review URL: https://codereview.chromium.org/1016823003
|
|
There are two issues in this bug.
One is that JP2 image is not displayed because it aborts loading Jpx bitmap when the number of components in color space is different with that one in JPX images. I found that the number of components in color space isn't updated after it's initialized. For index color space, the component shall inherit from its base color space.
The second issue is that displayed color is not correct after I fixed the first issue. The root cause is that sRGB is used in JPX image, it doesn't need to map from index to RGB again.
BUG=464215
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/1009513003
|
|
R=brucedawson@chromium.org
Review URL: https://codereview.chromium.org/837533003
|
|
BUG=429134
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/791223002
|
|
CPDF_Pattern objects are counted and maintained in m_PatternedMap.
When a CPDF_Pattern object "pattern" is deleted, it's address is marked as NULL in m_PatternMap.
This patch stores the address of CPDF_Pattern's adderss in all objects that references "pattern",
to ensure valid referencing after deletion.
BUG=416319, 419976, 418392
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/656753002
|
|
m_pDocument in CPDF_Color
If not forced clear, the counter of CPDF_Pattern will take care the count of referenced instance.
When forced clear, clear color first to make sure pattern still exists when referencing it.
BUG=411154
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/554913003
|
|
This will prevent using freed pattern object.
This is a better solution than https://pdfium.googlesource.com/pdfium/+/1b9c5c4dc41956b8c5ab17b9a882adf8a2513768
and in essence revert that patch
BUG=409373
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/522483003
|
|
BUG=406806
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/503883002
|
|
(patchset #1 of https://codereview.chromium.org/493163003/)
Reason for revert:
Needs to address comments before landing
Original issue's description:
> Use number of components from ICC profile and alternate color space
>
> BUG=406806
>
> Committed: https://pdfium.googlesource.com/pdfium/+/be83103
TBR=tsepez@chromium.org,jun_fang@foxitsoftware.com
NOTREECHECKS=true
NOTRY=true
BUG=406806
Review URL: https://codereview.chromium.org/504883003
|
|
BUG=406806
Review URL: https://codereview.chromium.org/493163003
|
|
From PDF reference 8.6.5.5, this could only be 1, 3 or 4.
BUG=387968
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/464083003
|
|
BUG=405588
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/496883002
|
|
space in CPDF_ColorSpace::Load
The test file defines a wrong color space object (7 0 obj). In the content of 7 0 obj,
the reserved obj (0 0 R) is used. The process of loading color space returns NULL when
the reserved obj (0 0 R) is found. For the error color space, it only needs to return
NULL when an error is detected.
BUG=403032
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/477413002
|
|
m_pBaseCS will be released in CPDF_DocPageData::Clear.
BUG=401372
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/472653002
|
|
with the old pattern
This patch is related to https://pdfium.googlesource.com/pdfium/+/1b9c5c4dc41956b8c5ab17b9a882adf8a2513768
BUG=402260
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/460383004
|
|
Patterns are managed in CPDF_DocPageData. When
a document is closed, all patterns will be
released in the deconstruction of CPDF_DocPageData.
However, some patterns which are referenced in
CPDF_Color can't get the notification from the
destroy of CPDF_DocPageData. It will cause
use-after-free in CPDF_Color::~CPDF_Color.
BUG=392719
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/439693002
|
|
No intended behavior change.
- Remove more unused variables, functions, member variables.
- Put a few constructor initializers in the order they execute in.
- Add braces for subobject initializers.
- Fix a handful of signed / unsigned comparisons.
BUG=pdfium:29
R=bo_xu@foxitsoftware.com
Review URL: https://codereview.chromium.org/429593005
|
|
BUG=pdfium:19
R=thestig@chromium.org
Review URL: https://codereview.chromium.org/403163002
|
|
BUG=386728
R=palmer@chromium.org
Review URL: https://codereview.chromium.org/397803002
|
|
BUG=387809
R=palmer@chromium.org
Review URL: https://codereview.chromium.org/379283003
|
|
BUG=
R=palmer@chromium.org
Review URL: https://codereview.chromium.org/372473003
|
|
BUG=387785
R=palmer@chromium.org
Review URL: https://codereview.chromium.org/362403002
|
|
BUG=386729
R=palmer@chromium.org
Review URL: https://codereview.chromium.org/366803003
|
|
BUG=
R=thakis@chromium.org
Review URL: https://codereview.chromium.org/361553002
|
|
BUG=382240
R=palmer@chromium.org
Review URL: https://codereview.chromium.org/332143002
|
|
|
|
|