From 28cad1534619d55820593baed0b6d6f3cbf767eb Mon Sep 17 00:00:00 2001 From: Lei Zhang Date: Wed, 2 May 2018 14:33:54 +0000 Subject: Make several Huffman decoders consistently check for integer overflows. BUG=chromium:837972 Change-Id: I6cfa28bff38870419e4b1e2bced427cfcbf843cd Reviewed-on: https://pdfium-review.googlesource.com/31912 Commit-Queue: Ryan Harrison Reviewed-by: Ryan Harrison --- core/fxcodec/jbig2/JBig2_Context.cpp | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) (limited to 'core/fxcodec/jbig2/JBig2_Context.cpp') diff --git a/core/fxcodec/jbig2/JBig2_Context.cpp b/core/fxcodec/jbig2/JBig2_Context.cpp index 1763144b49..b753380aa2 100644 --- a/core/fxcodec/jbig2/JBig2_Context.cpp +++ b/core/fxcodec/jbig2/JBig2_Context.cpp @@ -23,6 +23,7 @@ #include "core/fxcodec/jbig2/JBig2_PddProc.h" #include "core/fxcodec/jbig2/JBig2_SddProc.h" #include "core/fxcodec/jbig2/JBig2_TrdProc.h" +#include "core/fxcrt/fx_safe_types.h" #include "core/fxcrt/pauseindicator_iface.h" #include "third_party/base/ptr_util.h" @@ -1269,17 +1270,20 @@ std::vector CJBig2_Context::DecodeSymbolIDHuffmanTable( int32_t i = 0; while (i < static_cast(SBNUMSYMS)) { size_t j; - int32_t nVal = 0; + FX_SAFE_INT32 nSafeVal = 0; int32_t nBits = 0; uint32_t nTemp; while (true) { - if (nVal > std::numeric_limits::max() / 2 || - m_pStream->read1Bit(&nTemp) != 0) { + if (m_pStream->read1Bit(&nTemp) != 0) + return std::vector(); + + nSafeVal <<= 1; + if (!nSafeVal.IsValid()) return std::vector(); - } - nVal = (nVal << 1) | nTemp; + nSafeVal |= nTemp; ++nBits; + const int32_t nVal = nSafeVal.ValueOrDie(); for (j = 0; j < kRunCodesSize; ++j) { if (nBits == huffman_codes[j].codelen && nVal == huffman_codes[j].code) break; -- cgit v1.2.3