From a9eabe43437871b7b5f5569f0e3e1b9b3e01cedf Mon Sep 17 00:00:00 2001 From: Ryan Harrison Date: Wed, 14 Feb 2018 18:57:20 +0000 Subject: Check that the request was satisfied in ReadData Currently the BMP decompressor doesn't verify the returned data length was the amount requested. This means we may end up with part of our structure uninitialized if we didn't copy in enough data. This CL verifies the length of data copied is the size we require. BUG=chromium:811853 Change-Id: I20e0e9b3ff1176a620fcb38c3c7e585848b7e428 Reviewed-on: https://pdfium-review.googlesource.com/26850 Commit-Queue: Ryan Harrison Reviewed-by: dsinclair --- core/fxcodec/bmp/cfx_bmpdecompressor.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/fxcodec/bmp/cfx_bmpdecompressor.cpp b/core/fxcodec/bmp/cfx_bmpdecompressor.cpp index 71909d2732..d8f2b8d70b 100644 --- a/core/fxcodec/bmp/cfx_bmpdecompressor.cpp +++ b/core/fxcodec/bmp/cfx_bmpdecompressor.cpp @@ -637,7 +637,7 @@ int32_t CFX_BmpDecompressor::DecodeRLE4() { } bool CFX_BmpDecompressor::ReadData(uint8_t* destination, uint32_t size) { - return input_buffer_ && input_buffer_->ReadBlock(destination, size); + return input_buffer_ && input_buffer_->ReadBlock(destination, size) == size; } void CFX_BmpDecompressor::SaveDecodingStatus(int32_t status) { -- cgit v1.2.3