From ef81390393ef5fed1ba168cff081d459eed9f260 Mon Sep 17 00:00:00 2001 From: Lei Zhang Date: Wed, 1 Mar 2017 00:32:20 -0800 Subject: Fix infinite loops in CPDF_MeshStream. BUG=chromium:690501 Change-Id: I74b09d90a8082554a67f737eb6adc3bff82ed93e Reviewed-on: https://pdfium-review.googlesource.com/2889 Commit-Queue: dsinclair Reviewed-by: dsinclair --- core/fpdfapi/page/cpdf_meshstream.cpp | 37 +++++++++++++++++++++++++++-------- 1 file changed, 29 insertions(+), 8 deletions(-) (limited to 'core/fpdfapi/page/cpdf_meshstream.cpp') diff --git a/core/fpdfapi/page/cpdf_meshstream.cpp b/core/fpdfapi/page/cpdf_meshstream.cpp index 75069cab7f..24ef9b271e 100644 --- a/core/fpdfapi/page/cpdf_meshstream.cpp +++ b/core/fpdfapi/page/cpdf_meshstream.cpp @@ -154,6 +154,18 @@ bool CPDF_MeshStream::Load() { return true; } +bool CPDF_MeshStream::CanReadFlag() const { + return m_BitStream.BitsRemaining() >= m_nFlagBits; +} + +bool CPDF_MeshStream::CanReadCoords() const { + return m_BitStream.BitsRemaining() / 2 >= m_nCoordBits; +} + +bool CPDF_MeshStream::CanReadColor() const { + return m_BitStream.BitsRemaining() / m_nComponentBits >= m_nComponents; +} + uint32_t CPDF_MeshStream::ReadFlag() { ASSERT(ShouldCheckBitsPerFlag(m_type)); return m_BitStream.GetBits(m_nFlagBits) & 0x03; @@ -209,26 +221,35 @@ std::tuple CPDF_MeshStream::ReadColor() { return std::tuple(r, g, b); } -CPDF_MeshVertex CPDF_MeshStream::ReadVertex(const CFX_Matrix& pObject2Bitmap, - uint32_t* flag) { +bool CPDF_MeshStream::ReadVertex(const CFX_Matrix& pObject2Bitmap, + CPDF_MeshVertex* vertex, + uint32_t* flag) { + if (!CanReadFlag()) + return false; *flag = ReadFlag(); - CPDF_MeshVertex vertex; - vertex.position = pObject2Bitmap.Transform(ReadCoords()); - std::tie(vertex.r, vertex.g, vertex.b) = ReadColor(); - m_BitStream.ByteAlign(); + if (!CanReadCoords()) + return false; + vertex->position = pObject2Bitmap.Transform(ReadCoords()); - return vertex; + if (!CanReadColor()) + return false; + std::tie(vertex->r, vertex->g, vertex->b) = ReadColor(); + m_BitStream.ByteAlign(); + return true; } bool CPDF_MeshStream::ReadVertexRow(const CFX_Matrix& pObject2Bitmap, int count, CPDF_MeshVertex* vertex) { for (int i = 0; i < count; i++) { - if (m_BitStream.IsEOF()) + if (m_BitStream.IsEOF() || !CanReadCoords()) return false; vertex[i].position = pObject2Bitmap.Transform(ReadCoords()); + if (!CanReadColor()) + return false; + std::tie(vertex[i].r, vertex[i].g, vertex[i].b) = ReadColor(); m_BitStream.ByteAlign(); } -- cgit v1.2.3