Attachment #60106 for bug #137156

View | Details | Raw Unified | Return to bug 137156
Collapse All | Expand All

Lines 408-425 void ImageStream::skipLine() { Link Here

(-)Stream.cc (-1 / +36 lines)
408		408
409	StreamPredictor::StreamPredictor(Stream *strA, int predictorA,	409	StreamPredictor::StreamPredictor(Stream *strA, int predictorA,
410	int widthA, int nCompsA, int nBitsA) {	410	int widthA, int nCompsA, int nBitsA) {
		411	int totalBits;
		412
411	str = strA;	413	str = strA;
412	predictor = predictorA;	414	predictor = predictorA;
413	width = widthA;	415	width = widthA;
414	nComps = nCompsA;	416	nComps = nCompsA;
415	nBits = nBitsA;	417	nBits = nBitsA;
		418	predLine = NULL;
		419	ok = gFalse;
416		420
417	nVals = width * nComps;	421	nVals = width * nComps;
		422	totalBits = nVals * nBits;
		423	if (totalBits == 0 \|\|
		424	(totalBits / nBits) / nComps != width \|\|
		425	totalBits + 7 < 0) {
		426	return;
		427	}
418	pixBytes = (nComps * nBits + 7) >> 3;	428	pixBytes = (nComps * nBits + 7) >> 3;
419	rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;	429	rowBytes = ((totalBits + 7) >> 3) + pixBytes;
		430	if (rowBytes < 0) {
		431	return;
		432	}
420	predLine = (Guchar *)gmalloc(rowBytes);	433	predLine = (Guchar *)gmalloc(rowBytes);
421	memset(predLine, 0, rowBytes);	434	memset(predLine, 0, rowBytes);
422	predIdx = rowBytes;	435	predIdx = rowBytes;
		436
		437	ok = gTrue;
423	}	438	}
424		439
425	StreamPredictor::~StreamPredictor() {	440	StreamPredictor::~StreamPredictor() {
Lines 1013-1018 LZWStream::LZWStream(Stream *strA, int p Link Here
1013	FilterStream(strA) {	1028	FilterStream(strA) {
1014	if (predictor != 1) {	1029	if (predictor != 1) {
1015	pred = new StreamPredictor(this, predictor, columns, colors, bits);	1030	pred = new StreamPredictor(this, predictor, columns, colors, bits);
		1031	if (!pred->isOk()) {
		1032	delete pred;
		1033	pred = NULL;
		1034	}
1016	} else {	1035	} else {
1017	pred = NULL;	1036	pred = NULL;
1018	}	1037	}
Lines 2899-2904 GBool DCTStream::readBaselineSOF() { Link Here
2899	height = read16();	2918	height = read16();
2900	width = read16();	2919	width = read16();
2901	numComps = str->getChar();	2920	numComps = str->getChar();
		2921	if (numComps <= 0 \|\| numComps > 4) {
		2922	error(getPos(), "Bad number of components in DCT stream");
		2923	return gFalse;
		2924	}
2902	if (prec != 8) {	2925	if (prec != 8) {
2903	error(getPos(), "Bad DCT precision %d", prec);	2926	error(getPos(), "Bad DCT precision %d", prec);
2904	return gFalse;	2927	return gFalse;
Lines 2925-2930 GBool DCTStream::readProgressiveSOF() { Link Here
2925	height = read16();	2948	height = read16();
2926	width = read16();	2949	width = read16();
2927	numComps = str->getChar();	2950	numComps = str->getChar();
		2951	if (numComps <= 0 \|\| numComps > 4) {
		2952	error(getPos(), "Bad number of components in DCT stream");
		2953	return gFalse;
		2954	}
2928	if (prec != 8) {	2955	if (prec != 8) {
2929	error(getPos(), "Bad DCT precision %d", prec);	2956	error(getPos(), "Bad DCT precision %d", prec);
2930	return gFalse;	2957	return gFalse;
Lines 2947-2952 GBool DCTStream::readScanInfo() { Link Here
2947		2974
2948	length = read16() - 2;	2975	length = read16() - 2;
2949	scanInfo.numComps = str->getChar();	2976	scanInfo.numComps = str->getChar();
		2977	if (scanInfo.numComps <= 0 \|\| scanInfo.numComps > 4) {
		2978	error(getPos(), "Bad number of components in DCT stream");
		2979	return gFalse;
		2980	}
2950	--length;	2981	--length;
2951	if (length != 2 * scanInfo.numComps + 3) {	2982	if (length != 2 * scanInfo.numComps + 3) {
2952	error(getPos(), "Bad DCT scan info block");	2983	error(getPos(), "Bad DCT scan info block");
Lines 3258-3263 FlateStream::FlateStream(Stream *strA, i Link Here
3258	FilterStream(strA) {	3289	FilterStream(strA) {
3259	if (predictor != 1) {	3290	if (predictor != 1) {
3260	pred = new StreamPredictor(this, predictor, columns, colors, bits);	3291	pred = new StreamPredictor(this, predictor, columns, colors, bits);
		3292	if (!pred->isOk()) {
		3293	delete pred;
		3294	pred = NULL;
		3295	}
3261	} else {	3296	} else {
3262	pred = NULL;	3297	pred = NULL;
3263	}	3298	}

Lines 233-238 public: Link Here

(-)Stream.h (+3 lines)
233		233
234	~StreamPredictor();	234	~StreamPredictor();
235		235
		236	GBool isOk() { return ok; }
		237
236	int lookChar();	238	int lookChar();
237	int getChar();	239	int getChar();
238		240
Lines 250-255 private: Link Here
250	int rowBytes; // bytes per line	252	int rowBytes; // bytes per line
251	Guchar *predLine; // line buffer	253	Guchar *predLine; // line buffer
252	int predIdx; // current index in predLine	254	int predIdx; // current index in predLine
		255	GBool ok;
253	};	256	};
254		257
255	//------------------------------------------------------------------------	258	//------------------------------------------------------------------------

Lines 666-672 GBool JPXStream::readCodestream(Guint /* Link Here

(-)JPXStream.cc (-3 / +7 lines)
666	int segType;	666	int segType;
667	GBool haveSIZ, haveCOD, haveQCD, haveSOT;	667	GBool haveSIZ, haveCOD, haveQCD, haveSOT;
668	Guint precinctSize, style;	668	Guint precinctSize, style;
669	Guint segLen, capabilities, comp, i, j, r;	669	Guint segLen, capabilities, nTiles, comp, i, j, r;
670		670
671	//----- main header	671	//----- main header
672	haveSIZ = haveCOD = haveQCD = haveSOT = gFalse;	672	haveSIZ = haveCOD = haveQCD = haveSOT = gFalse;
Lines 701-708 GBool JPXStream::readCodestream(Guint /* Link Here
701	/ img.xTileSize;	701	/ img.xTileSize;
702	img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1)	702	img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1)
703	/ img.yTileSize;	703	/ img.yTileSize;
704	img.tiles = (JPXTile )gmalloc(img.nXTiles img.nYTiles *	704	nTiles = img.nXTiles * img.nYTiles;
705	sizeof(JPXTile));	705	if (img.nXTiles == 0 \|\| nTiles / img.nXTiles != img.nYTiles) {
		706	error(getPos(), "Bad tile count in JPX SIZ marker segment");
		707	return gFalse;
		708	}
		709	img.tiles = (JPXTile *)gmallocn(nTiles, sizeof(JPXTile));
706	for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {	710	for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {
707	img.tiles[i].tileComps = (JPXTileComp )gmalloc(img.nComps	711	img.tiles[i].tileComps = (JPXTileComp )gmalloc(img.nComps
708	sizeof(JPXTileComp));	712	sizeof(JPXTileComp));

Return to bug 137156