From fdcc8744f8f7d807bf0dbc761cdc8d6a6e0798cb Mon Sep 17 00:00:00 2001 From: Bo Xu Date: Wed, 27 Aug 2014 16:01:41 -0700 Subject: Restrict index not be greater than row_size in TIFF_PredictLine There is not strict way to limit invalid value of |Colors| from dictionary. We can make sure |index| does not go out of boundary of row_size. BUG=407614 R=tsepez@chromium.org Review URL: https://codereview.chromium.org/509993003 --- core/src/fxcodec/codec/fx_codec_flate.cpp | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/core/src/fxcodec/codec/fx_codec_flate.cpp b/core/src/fxcodec/codec/fx_codec_flate.cpp index a12fffbe5c..e17c32a2c7 100644 --- a/core/src/fxcodec/codec/fx_codec_flate.cpp +++ b/core/src/fxcodec/codec/fx_codec_flate.cpp @@ -524,17 +524,19 @@ static void TIFF_PredictorEncode(FX_LPBYTE& data_buf, FX_DWORD& data_size, static void TIFF_PredictLine(FX_LPBYTE dest_buf, int row_size, int BitsPerComponent, int Colors, int Columns) { if (BitsPerComponent == 1) { - int row_bits = BitsPerComponent * Colors * Columns; + int row_bits = FX_MIN(BitsPerComponent * Colors * Columns, row_size * 8); + int index_pre = 0; + int col_pre = 0; for(int i = 1; i < row_bits; i ++) { int col = i % 8; int index = i / 8; - int index_pre = (col == 0) ? (index - 1) : index; - int col_pre = (col == 0) ? 8 : col; - if( ((dest_buf[index] >> (7 - col)) & 1) ^ ((dest_buf[index_pre] >> (8 - col_pre)) & 1) ) { + if( ((dest_buf[index] >> (7 - col)) & 1) ^ ((dest_buf[index_pre] >> (7 - col_pre)) & 1) ) { dest_buf[index] |= 1 << (7 - col); } else { dest_buf[index] &= ~(1 << (7 - col)); } + index_pre = index; + col_pre = col; } return; } -- cgit v1.2.3