Age | Commit message (Collapse) | Author |
|
This avoids unchecked multiplications when computing a size argument
to malloc(). Such an overflow is very scary, and can result in
exploitable bugs.
Along the way, kill off some return checks, since we know this can't
return NULL.
R=thestig@chromium.org
Review URL: https://codereview.chromium.org/1143663004
|
|
There isn't much point in having macros that obscure obvious
language features.
R=thestig@chromium.org
Review URL: https://codereview.chromium.org/1135273004
|
|
Also fix a few nits and other errors along the way.
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/1098583002
|
|
Failure to check document-controlled value before using it.
BUG=481363
R=palmer@chromium.org, thestig@chromium.org
Review URL: https://codereview.chromium.org/1110653002
|
|
Removing the implicit cast operator forces a build breakage should we
use ByteStringC in STL containers. Adding an operator< restores correct
behaviour. Adding an operator[] avoids re-writing some code to call
GetPtr() prior to array indexing.
Part 1 of 4.
R=thestig@chromium.org
TBR=brucedawson@chromium.org
BUG=pdfium:142.
Review URL: https://codereview.chromium.org/1090303003
|
|
BUG=pdfium:140
R=thestig@chromium.org
Review URL: https://codereview.chromium.org/1093213002
|
|
Very few places where a change is required, but remove FX_NEW to show
they've been audited.
R=thestig@chromium.org
Review URL: https://codereview.chromium.org/1075953004
|
|
CFX_Object is a type that implements its own new operators that return
NULL on error. There's no need for this given the |new (std::nothrow)|
syntax; in fact, the current code can only work if there is no activity
in the constructors. This may explain the pervasive lack of
constructors and reliance on Init() methods throughout the codebase.
The activity takes place in fx_memory.h, where FX_NEW is mapped onto
the std::nothrow syntax. The rest is just cleanup.
Down the road, we will simply throw and remove all the error-checking
paths for new objects. Landing this patch first will at least show a
simple path back to the old behaviour without having to re-introduce
CFX_Object should someone want to do so in their own fork.
R=thestig@chromium.org
Review URL: https://codereview.chromium.org/1088733002
|
|
Add a check to make sure offset is less than the size of string in the function of GetNextChar().
BUG=471651
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/1067073003
|
|
space is used"
This reverts commit 5a0e504d53195892458d819e52c62bea0c710bd5.
Original review URL https://codereview.chromium.org/1009513003
Reason for revert: New "corpus" tests show that this is no longer rendering some images. See, e.g. http://chromegw/i/client.pdfium/builders/linux/builds/144/steps/corpus%20tests/logs/stdio for those that diff'd.
TBR=jun_fang@foxitsoftware.com
Review URL: https://codereview.chromium.org/1016823003
|
|
There are two issues in this bug.
One is that JP2 image is not displayed because it aborts loading Jpx bitmap when the number of components in color space is different with that one in JPX images. I found that the number of components in color space isn't updated after it's initialized. For index color space, the component shall inherit from its base color space.
The second issue is that displayed color is not correct after I fixed the first issue. The root cause is that sRGB is used in JPX image, it doesn't need to map from index to RGB again.
BUG=464215
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/1009513003
|
|
This issue was introduced in https://codereview.chromium.org/886953002/.
BUG=454280
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/869343008
|
|
Any projects DEPS'd into chromium and requiring a /base
subset should have a local copy of that subset in a
separate namespace. This will avoid future naming conflicts.
Re-arrange the directory structure to better identify what
came from chromium's base, and to make drop-in replacement
easier for files that contain hard-coded "base/" in their
#include directives.
R=jam@chromium.org
Review URL: https://codereview.chromium.org/900753002
|
|
Headers in /include directories should be free of implementation details
from third_party. Put the types into a new header outside of /include.
Requires https://codereview.chromium.org/902443003/ before a version containing this patch is rolled into chromium.
R=jam@chromium.org
Review URL: https://codereview.chromium.org/896023003
|
|
This issue was caused by integer overflow in CPDF_SampledFunc::v_Call.
The root cause of this issue is that the content in the test pdf file
was damaged. The solution is to check whether an integer is overflow
before using it.
BUG=452455
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/886953002
|
|
While we're at it, avoid an indirection through a pointer, and
use a name that isn't reserved for the compiler (leading _ CAP).
This is a small portion of the associated bug:
BUG=https://code.google.com/p/pdfium/issues/detail?id=112
R=brucedawson@chromium.org
Review URL: https://codereview.chromium.org/880663003
|
|
R=brucedawson@chromium.org
Review URL: https://codereview.chromium.org/837533003
|
|
Follow up on https://codereview.chromium.org/733693003
R=brucedawson@chromium.org, tsepez@chromium.org
Review URL: https://codereview.chromium.org/809993004
|
|
-remove parameter from FPDF_InitLibrary
-remove a bunch of ifdefs that are unused
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/801913002
|
|
BUG=429134
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/791223002
|
|
The flag variable is conditionally initialized but unconditionally read.
Warning was:
src\fpdfapi\fpdf_page\fpdf_page_pattern.cpp(274) : warning C6001:
Using uninitialized memory 'flag'.
BUG=427616
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/703213004
|
|
CPDF_Pattern objects are counted and maintained in m_PatternedMap.
When a CPDF_Pattern object "pattern" is deleted, it's address is marked as NULL in m_PatternMap.
This patch stores the address of CPDF_Pattern's adderss in all objects that references "pattern",
to ensure valid referencing after deletion.
BUG=416319, 419976, 418392
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/656753002
|
|
CPDF_StreamContentParser::Parse.
This is just a bit of defensive programming; I'm not sure the situation can
occur in the current code, but the following code is likely to set off a red
flag to anyone who reads it:
CPDF_StreamParser syntax(pData, dwSize);
m_pSyntax = &syntax;
since the extent of the local |syntax| is far less than the pointer member
|m_pSyntax|. NULL it out before syntax goes out of scope.
R=jun_fang@foxitsoftware.com
Review URL: https://codereview.chromium.org/652063002
|
|
Images are basic resource and are referred or used by other objects in some cases. Images should be released after the objects who uses these objects. In this case, an image object is accessed in the process of CPDF_TilingPattern's destroy. Unlikely, this image has been destroyed before.
BUG=414046
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/582993002
|
|
pattern
BUG=414661
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/572853006
|
|
m_pDocument in CPDF_Color
If not forced clear, the counter of CPDF_Pattern will take care the count of referenced instance.
When forced clear, clear color first to make sure pattern still exists when referencing it.
BUG=411154
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/554913003
|
|
This will prevent using freed pattern object.
This is a better solution than https://pdfium.googlesource.com/pdfium/+/1b9c5c4dc41956b8c5ab17b9a882adf8a2513768
and in essence revert that patch
BUG=409373
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/522483003
|
|
CPDF_DocPageData::~CPDF_DocPageData() will force to release all resources, so no need to do it here, which can result in heap-use-after-free trouble.
BUG=408164
R=jun_fang@foxitsoftware.com, tsepez@chromium.org
Review URL: https://codereview.chromium.org/513063003
|
|
BUG=406806
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/503883002
|
|
(patchset #1 of https://codereview.chromium.org/493163003/)
Reason for revert:
Needs to address comments before landing
Original issue's description:
> Use number of components from ICC profile and alternate color space
>
> BUG=406806
>
> Committed: https://pdfium.googlesource.com/pdfium/+/be83103
TBR=tsepez@chromium.org,jun_fang@foxitsoftware.com
NOTREECHECKS=true
NOTRY=true
BUG=406806
Review URL: https://codereview.chromium.org/504883003
|
|
BUG=406806
Review URL: https://codereview.chromium.org/493163003
|
|
From PDF reference 8.6.5.5, this could only be 1, 3 or 4.
BUG=387968
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/464083003
|
|
BUG=405588
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/496883002
|
|
BUG=400996
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/477323002
|
|
space in CPDF_ColorSpace::Load
The test file defines a wrong color space object (7 0 obj). In the content of 7 0 obj,
the reserved obj (0 0 R) is used. The process of loading color space returns NULL when
the reserved obj (0 0 R) is found. For the error color space, it only needs to return
NULL when an error is detected.
BUG=403032
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/477413002
|
|
m_pBaseCS will be released in CPDF_DocPageData::Clear.
BUG=401372
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/472653002
|
|
This has no ill-effect at present, but may be distracting when viewing the file
since it just looks wrong.
R=jun_fang@foxitsoftware.com
Review URL: https://codereview.chromium.org/461933003
|
|
with the old pattern
This patch is related to https://pdfium.googlesource.com/pdfium/+/1b9c5c4dc41956b8c5ab17b9a882adf8a2513768
BUG=402260
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/460383004
|
|
Patterns are managed in CPDF_DocPageData. When
a document is closed, all patterns will be
released in the deconstruction of CPDF_DocPageData.
However, some patterns which are referenced in
CPDF_Color can't get the notification from the
destroy of CPDF_DocPageData. It will cause
use-after-free in CPDF_Color::~CPDF_Color.
BUG=392719
R=tsepez@chromium.org
Review URL: https://codereview.chromium.org/439693002
|
|
No intended behavior change.
- Remove more unused variables, functions, member variables.
- Put a few constructor initializers in the order they execute in.
- Add braces for subobject initializers.
- Fix a handful of signed / unsigned comparisons.
BUG=pdfium:29
R=bo_xu@foxitsoftware.com
Review URL: https://codereview.chromium.org/429593005
|
|
BUG=pdfium:19
R=thestig@chromium.org
Review URL: https://codereview.chromium.org/403163002
|
|
BUG=386728
R=palmer@chromium.org
Review URL: https://codereview.chromium.org/397803002
|
|
BUG=387809
R=palmer@chromium.org
Review URL: https://codereview.chromium.org/379283003
|
|
BUG=
R=palmer@chromium.org
Review URL: https://codereview.chromium.org/372473003
|
|
BUG=387785
R=palmer@chromium.org
Review URL: https://codereview.chromium.org/362403002
|
|
BUG=386729
R=palmer@chromium.org
Review URL: https://codereview.chromium.org/366803003
|
|
BUG=
R=thakis@chromium.org
Review URL: https://codereview.chromium.org/361553002
|
|
BUG=382240
R=palmer@chromium.org
Review URL: https://codereview.chromium.org/332143002
|
|
wrong characters representation, and addjust some code indent
BUG=
R=jam@chromium.org
Review URL: https://codereview.chromium.org/294353002
|
|
|