blob: 757924ba8df8398a256a22c98f538a978b2b64a7 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
|
$NetBSD: patch-af,v 1.1 2007/08/02 14:41:19 drochner Exp $
--- poppler/Stream.cc.orig 2007-08-02 10:28:59.000000000 +0200
+++ poppler/Stream.cc
@@ -422,12 +422,6 @@ StreamPredictor::StreamPredictor(Stream
ok = gFalse;
nVals = width * nComps;
- if (width <= 0 || nComps <= 0 || nBits <= 0 ||
- nComps >= INT_MAX/nBits ||
- width >= INT_MAX/nComps/nBits ||
- nVals * nBits + 7 < 0) {
- return;
- }
totalBits = nVals * nBits;
if (totalBits == 0 ||
(totalBits / nBits) / nComps != width ||
@@ -436,7 +430,11 @@ StreamPredictor::StreamPredictor(Stream
}
pixBytes = (nComps * nBits + 7) >> 3;
rowBytes = ((totalBits + 7) >> 3) + pixBytes;
- if (rowBytes < 0) {
+ if (width <= 0 || nComps <= 0 || nBits <= 0 ||
+ nComps > gfxColorMaxComps ||
+ nBits > 16 ||
+ width >= INT_MAX / nComps || // check for overflow in nVals
+ nVals >= (INT_MAX - 7) / nBits) { // check for overflow in rowBytes
return;
}
predLine = (Guchar *)gmalloc(rowBytes);
|
