From 3a0a808ff546b5633a2384f4ed156b7ced605c90 Mon Sep 17 00:00:00 2001 From: kcwu Date: Thu, 6 Oct 2016 12:29:17 -0700 Subject: Fix assertion failure when decoding malform G4 fax image The position indexes of color elements must be monotonic increasing. Bail out if the decoded index is less or equal to the previous index. BUG=pdfium:615 Review-Url: https://codereview.chromium.org/2398033002 --- core/fxcodec/codec/fx_codec_fax.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/core/fxcodec/codec/fx_codec_fax.cpp b/core/fxcodec/codec/fx_codec_fax.cpp index 336c35b8d4..c121478c3c 100644 --- a/core/fxcodec/codec/fx_codec_fax.cpp +++ b/core/fxcodec/codec/fx_codec_fax.cpp @@ -390,6 +390,10 @@ FX_BOOL FaxG4GetRow(const uint8_t* src_buf, if (a1 >= columns) return TRUE; + // The position of picture element must be monotonic increasing. + if (a0 >= a1) + return FALSE; + a0 = a1; a0color = !a0color; } -- cgit v1.2.3