From 131c0eb2e34ece6ede6288842cb3004ec3c600d4 Mon Sep 17 00:00:00 2001 From: Lei Zhang Date: Fri, 8 Sep 2017 15:38:21 -0700 Subject: Fix an off by 1 error in TIFF_PredictLine(). BUG=chromium:762106 Change-Id: I714d69320cc4fb81d535f811c18d4ef91fec44d3 Reviewed-on: https://pdfium-review.googlesource.com/13212 Commit-Queue: Lei Zhang Reviewed-by: Tom Sepez --- core/fxcodec/codec/fx_codec_flate.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/fxcodec/codec/fx_codec_flate.cpp b/core/fxcodec/codec/fx_codec_flate.cpp index 02be295ce6..6482d52ed8 100644 --- a/core/fxcodec/codec/fx_codec_flate.cpp +++ b/core/fxcodec/codec/fx_codec_flate.cpp @@ -472,7 +472,7 @@ void TIFF_PredictLine(uint8_t* dest_buf, } int BytesPerPixel = BitsPerComponent * Colors / 8; if (BitsPerComponent == 16) { - for (uint32_t i = BytesPerPixel; i < row_size; i += 2) { + for (uint32_t i = BytesPerPixel; i + 1 < row_size; i += 2) { uint16_t pixel = (dest_buf[i - BytesPerPixel] << 8) | dest_buf[i - BytesPerPixel + 1]; pixel += (dest_buf[i] << 8) | dest_buf[i + 1]; -- cgit v1.2.3