blob: cd42fb962d3b64fdc609c67a1d3d30d898d1697b (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
|
*** xpdf-3.02.orig/xpdf/Stream.cc Tue Feb 27 14:05:52 2007
--- xpdf-3.02/xpdf/Stream.cc Thu Jul 26 14:44:43 2007
***************
*** 410,424 ****
ok = gFalse;
nVals = width * nComps;
- if (width <= 0 || nComps <= 0 || nBits <= 0 ||
- nComps >= INT_MAX / nBits ||
- width >= INT_MAX / nComps / nBits ||
- nVals * nBits + 7 < 0) {
- return;
- }
pixBytes = (nComps * nBits + 7) >> 3;
rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
! if (rowBytes <= 0) {
return;
}
predLine = (Guchar *)gmalloc(rowBytes);
--- 410,422 ----
ok = gFalse;
nVals = width * nComps;
pixBytes = (nComps * nBits + 7) >> 3;
rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
! if (width <= 0 || nComps <= 0 || nBits <= 0 ||
! nComps > gfxColorMaxComps ||
! nBits > 16 ||
! width >= INT_MAX / nComps || // check for overflow in nVals
! nVals >= (INT_MAX - 7) / nBits) { // check for overflow in rowBytes
return;
}
predLine = (Guchar *)gmalloc(rowBytes);
|
