View | Details | Raw Unified | Return to bug 137156
Collapse All | Expand All

(-)xpdf/xpdf/Stream.h (+3 lines)
Lines 217-222 public: Link Here
217
217
218
  ~StreamPredictor();
218
  ~StreamPredictor();
219
219
220
  GBool isOk() { return ok; }
221
220
  int lookChar();
222
  int lookChar();
221
  int getChar();
223
  int getChar();
222
224
Lines 234-239 private: Link Here
234
  int rowBytes;			// bytes per line
236
  int rowBytes;			// bytes per line
235
  Guchar *predLine;		// line buffer
237
  Guchar *predLine;		// line buffer
236
  int predIdx;			// current index in predLine
238
  int predIdx;			// current index in predLine
239
  GBool ok;
237
};
240
};
238
241
239
//------------------------------------------------------------------------
242
//------------------------------------------------------------------------
(-)xpdf/xpdf/Stream.cc (-2 / +39 lines)
Lines 13-18 Link Here
13
#include <stdio.h>
13
#include <stdio.h>
14
#include <stdlib.h>
14
#include <stdlib.h>
15
#include <stddef.h>
15
#include <stddef.h>
16
#include <limits.h>
16
#ifndef WIN32
17
#ifndef WIN32
17
#include <unistd.h>
18
#include <unistd.h>
18
#endif
19
#endif
Lines 414-425 StreamPredictor::StreamPredictor(Stream Link Here
414
  this->nComps = nComps;
415
  this->nComps = nComps;
415
  this->nBits = nBits;
416
  this->nBits = nBits;
416
417
418
  predLine = NULL;
419
  ok = gFalse;
420
421
  if (width <= 0 || nComps <= 0 || nBits <= 0 ||
422
      nComps >= INT_MAX/nBits ||
423
      width >= INT_MAX/nComps/nBits) {
424
    return;
425
  }
426
417
  nVals = width * nComps;
427
  nVals = width * nComps;
428
  if (nVals * nBits + 7 <= 0) {
429
    return;
430
  }
418
  pixBytes = (nComps * nBits + 7) >> 3;
431
  pixBytes = (nComps * nBits + 7) >> 3;
419
  rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
432
  rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
433
  if (rowBytes < 0) {
434
    return;
435
  }
420
  predLine = (Guchar *)gmalloc(rowBytes);
436
  predLine = (Guchar *)gmalloc(rowBytes);
421
  memset(predLine, 0, rowBytes);
437
  memset(predLine, 0, rowBytes);
422
  predIdx = rowBytes;
438
  predIdx = rowBytes;
439
440
  ok = gTrue;
423
}
441
}
424
442
425
StreamPredictor::~StreamPredictor() {
443
StreamPredictor::~StreamPredictor() {
Lines 852-857 LZWStream::LZWStream(Stream *str, int pr Link Here
852
    FilterStream(str) {
870
    FilterStream(str) {
853
  if (predictor1 != 1) {
871
  if (predictor1 != 1) {
854
    pred = new StreamPredictor(this, predictor1, columns1, colors1, bits1);
872
    pred = new StreamPredictor(this, predictor1, columns1, colors1, bits1);
873
    if (!pred->isOk()) {
874
      delete pred;
875
      pred = NULL;
876
    }
855
  } else {
877
  } else {
856
    pred = NULL;
878
    pred = NULL;
857
  }
879
  }
Lines 1275-1280 CCITTFaxStream::CCITTFaxStream(Stream *s Link Here
1275
  this->rows = rows;
1297
  this->rows = rows;
1276
  this->endOfBlock = endOfBlock;
1298
  this->endOfBlock = endOfBlock;
1277
  this->black = black;
1299
  this->black = black;
1300
  if (columns < 1 || columns >= INT_MAX / sizeof(short)) {
1301
    error(-1, "invalid number of columns");
1302
    exit(1);
1303
  }
1278
  refLine = (short *)gmalloc((columns + 3) * sizeof(short));
1304
  refLine = (short *)gmalloc((columns + 3) * sizeof(short));
1279
  codingLine = (short *)gmalloc((columns + 2) * sizeof(short));
1305
  codingLine = (short *)gmalloc((columns + 2) * sizeof(short));
1280
1306
Lines 2573-2578 GBool DCTStream::readFrameInfo() { Link Here
2573
  height = read16();
2599
  height = read16();
2574
  width = read16();
2600
  width = read16();
2575
  numComps = str->getChar();
2601
  numComps = str->getChar();
2602
  if (numComps <= 0 || numComps > 4) {
2603
    numComps = 0;
2604
    error(getPos(), "Bad number of components in DCT stream");
2605
    return gFalse;
2606
  }
2576
  length -= 6;
2607
  length -= 6;
2577
  if (prec != 8) {
2608
  if (prec != 8) {
2578
    error(getPos(), "Bad DCT precision %d", prec);
2609
    error(getPos(), "Bad DCT precision %d", prec);
Lines 2658-2669 GBool DCTStream::readHuffmanTables() { Link Here
2658
  while (length > 0) {
2689
  while (length > 0) {
2659
    index = str->getChar();
2690
    index = str->getChar();
2660
    --length;
2691
    --length;
2661
    if ((index & 0x0f) >= 4) {
2692
    if ((index & ~0x10) >= 4 || (index & ~0x10) < 0) {
2662
      error(getPos(), "Bad DCT Huffman table");
2693
      error(getPos(), "Bad DCT Huffman table");
2663
      return gFalse;
2694
      return gFalse;
2664
    }
2695
    }
2665
    if (index & 0x10) {
2696
    if (index & 0x10) {
2666
      index &= 0x0f;
2697
      index &= 0x03;
2667
      if (index >= numACHuffTables)
2698
      if (index >= numACHuffTables)
2668
	numACHuffTables = index+1;
2699
	numACHuffTables = index+1;
2669
      tbl = &acHuffTables[index];
2700
      tbl = &acHuffTables[index];
Lines 2743-2751 int DCTStream::readMarker() { Link Here
2743
  do {
2774
  do {
2744
    do {
2775
    do {
2745
      c = str->getChar();
2776
      c = str->getChar();
2777
      if(c == EOF) return EOF;
2746
    } while (c != 0xff);
2778
    } while (c != 0xff);
2747
    do {
2779
    do {
2748
      c = str->getChar();
2780
      c = str->getChar();
2781
      if(c == EOF) return EOF;
2749
    } while (c == 0xff);
2782
    } while (c == 0xff);
2750
  } while (c == 0x00);
2783
  } while (c == 0x00);
2751
  return c;
2784
  return c;
Lines 2851-2856 FlateStream::FlateStream(Stream *str, in Link Here
2851
    FilterStream(str) {
2884
    FilterStream(str) {
2852
  if (predictor1 != 1) {
2885
  if (predictor1 != 1) {
2853
    pred = new StreamPredictor(this, predictor1, columns1, colors1, bits1);
2886
    pred = new StreamPredictor(this, predictor1, columns1, colors1, bits1);
2887
    if (!pred->isOk()) {
2888
      delete pred;
2889
      pred = NULL;
2890
    }
2854
  } else {
2891
  } else {
2855
    pred = NULL;
2892
    pred = NULL;
2856
  }
2893
  }

Return to bug 137156