From 4ca5ba4dec653aff28d14c9f48715e93e8dfd490 Mon Sep 17 00:00:00 2001 From: Nicolas Pena Date: Mon, 13 Mar 2017 15:09:05 -0400 Subject: Fix boundary value negation in bmp_read_header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When the value read is equal to -INT_MIN, we cannot negate it since it will be out of bounds, so return error in this case. BUG=chromium:628559 Change-Id: I7e47a71ef0d35cfb2d1fddc0ba644f9aac79ec3f Reviewed-on: https://pdfium-review.googlesource.com/2965 Reviewed-by: Tom Sepez Commit-Queue: Nicolás Peña --- core/fxcodec/lbmp/fx_bmp.cpp | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'core') diff --git a/core/fxcodec/lbmp/fx_bmp.cpp b/core/fxcodec/lbmp/fx_bmp.cpp index 13525b807d..6d4fb51fcd 100644 --- a/core/fxcodec/lbmp/fx_bmp.cpp +++ b/core/fxcodec/lbmp/fx_bmp.cpp @@ -7,6 +7,7 @@ #include "core/fxcodec/lbmp/fx_bmp.h" #include +#include namespace { @@ -129,6 +130,10 @@ int32_t bmp_read_header(bmp_decompress_struct_p bmp_ptr) { bmp_ptr->dpi_y = (int32_t)GetDWord_LSBFirst( (uint8_t*)&bmp_info_header_ptr->biYPelsPerMeter); if (bmp_ptr->height < 0) { + if (bmp_ptr->height == std::numeric_limits::min()) { + bmp_error(bmp_ptr, "Unsupported height"); + return 0; + } bmp_ptr->height = -bmp_ptr->height; bmp_ptr->imgTB_flag = true; } @@ -159,6 +164,10 @@ int32_t bmp_read_header(bmp_decompress_struct_p bmp_ptr) { bmp_ptr->dpi_y = GetDWord_LSBFirst( (uint8_t*)&bmp_info_header_ptr->biYPelsPerMeter); if (bmp_ptr->height < 0) { + if (bmp_ptr->height == std::numeric_limits::min()) { + bmp_error(bmp_ptr, "Unsupported height"); + return 0; + } bmp_ptr->height = -bmp_ptr->height; bmp_ptr->imgTB_flag = true; } -- cgit v1.2.3