140 lines
3.8 KiB
Diff
140 lines
3.8 KiB
Diff
--- xpdf-3.01/xpdf/JBIG2Stream.cc.chris-overflows 2005-08-16 23:34:31.000000000 -0600
|
|
+++ xpdf-3.01/xpdf/JBIG2Stream.cc 2006-01-03 16:31:21.707918696 -0700
|
|
@@ -7,6 +7,7 @@
|
|
//========================================================================
|
|
|
|
#include <aconf.h>
|
|
+#include <limits.h>
|
|
|
|
#ifdef USE_GCC_PRAGMAS
|
|
#pragma implementation
|
|
@@ -681,6 +682,13 @@
|
|
w = wA;
|
|
h = hA;
|
|
line = (wA + 7) >> 3;
|
|
+
|
|
+ if (h < 0 || line <= 0 || h >= (INT_MAX - 1) / line) {
|
|
+ error(-1, "invalid width/height");
|
|
+ data = NULL;
|
|
+ return;
|
|
+ }
|
|
+
|
|
// need to allocate one extra guard byte for use in combine()
|
|
data = (Guchar *)gmalloc(h * line + 1);
|
|
data[h * line] = 0;
|
|
@@ -692,6 +700,13 @@
|
|
w = bitmap->w;
|
|
h = bitmap->h;
|
|
line = bitmap->line;
|
|
+
|
|
+ if (h < 0 || line <= 0 || h >= (INT_MAX - 1) / line) {
|
|
+ error(-1, "invalid width/height");
|
|
+ data = NULL;
|
|
+ return;
|
|
+ }
|
|
+
|
|
// need to allocate one extra guard byte for use in combine()
|
|
data = (Guchar *)gmalloc(h * line + 1);
|
|
memcpy(data, bitmap->data, h * line);
|
|
@@ -720,7 +735,10 @@
|
|
}
|
|
|
|
void JBIG2Bitmap::expand(int newH, Guint pixel) {
|
|
- if (newH <= h) {
|
|
+ if (newH <= h || line <= 0 || newH >= (INT_MAX - 1) / line) {
|
|
+ error(-1, "invalid width/height");
|
|
+ gfree(data);
|
|
+ data = NULL;
|
|
return;
|
|
}
|
|
// need to allocate one extra guard byte for use in combine()
|
|
@@ -2305,6 +2323,15 @@
|
|
error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");
|
|
return;
|
|
}
|
|
+ if (gridH == 0 || gridW >= INT_MAX / gridH) {
|
|
+ error(getPos(), "Bad size in JBIG2 halftone segment");
|
|
+ return;
|
|
+ }
|
|
+ if (w == 0 || h >= INT_MAX / w) {
|
|
+ error(getPos(), "Bad size in JBIG2 bitmap segment");
|
|
+ return;
|
|
+ }
|
|
+
|
|
patternDict = (JBIG2PatternDict *)seg;
|
|
bpp = 0;
|
|
i = 1;
|
|
@@ -2936,6 +2963,11 @@
|
|
JBIG2BitmapPtr tpgrCXPtr0, tpgrCXPtr1, tpgrCXPtr2;
|
|
int x, y, pix;
|
|
|
|
+ if (w < 0 || h <= 0 || w >= INT_MAX / h) {
|
|
+ error(-1, "invalid width/height");
|
|
+ return NULL;
|
|
+ }
|
|
+
|
|
bitmap = new JBIG2Bitmap(0, w, h);
|
|
bitmap->clearToZero();
|
|
|
|
--- xpdf-3.01/xpdf/Stream.cc.chris-overflows 2006-01-03 16:16:25.239630341 -0700
|
|
+++ xpdf-3.01/xpdf/Stream.cc 2006-01-03 16:44:17.794143711 -0700
|
|
@@ -1276,8 +1276,9 @@
|
|
endOfLine = endOfLineA;
|
|
byteAlign = byteAlignA;
|
|
columns = columnsA;
|
|
- if (columns < 1) {
|
|
- columns = 1;
|
|
+ if (columns < 1 || columns >= INT_MAX / sizeof(short)) {
|
|
+ error(getPos(), "Bad number of columns: %d in CCITTFaxStream", columns);
|
|
+ exit(1);
|
|
}
|
|
rows = rowsA;
|
|
endOfBlock = endOfBlockA;
|
|
@@ -2920,6 +2921,7 @@
|
|
width = read16();
|
|
numComps = str->getChar();
|
|
if (numComps <= 0 || numComps > 4) {
|
|
+ numComps = 0;
|
|
error(getPos(), "Bad number of components in DCT stream", prec);
|
|
return gFalse;
|
|
}
|
|
@@ -2950,6 +2952,7 @@
|
|
width = read16();
|
|
numComps = str->getChar();
|
|
if (numComps <= 0 || numComps > 4) {
|
|
+ numComps = 0;
|
|
error(getPos(), "Bad number of components in DCT stream", prec);
|
|
return gFalse;
|
|
}
|
|
@@ -2976,6 +2979,7 @@
|
|
length = read16() - 2;
|
|
scanInfo.numComps = str->getChar();
|
|
if (scanInfo.numComps <= 0 || scanInfo.numComps > 4) {
|
|
+ scanInfo.numComps = 0;
|
|
error(getPos(), "Bad number of components in DCT stream");
|
|
return gFalse;
|
|
}
|
|
@@ -3063,12 +3067,12 @@
|
|
while (length > 0) {
|
|
index = str->getChar();
|
|
--length;
|
|
- if ((index & 0x0f) >= 4) {
|
|
+ if ((index & ~0x10) >= 4 || (index & ~0x10) < 0) {
|
|
error(getPos(), "Bad DCT Huffman table");
|
|
return gFalse;
|
|
}
|
|
if (index & 0x10) {
|
|
- index &= 0x0f;
|
|
+ index &= 0x03;
|
|
if (index >= numACHuffTables)
|
|
numACHuffTables = index+1;
|
|
tbl = &acHuffTables[index];
|
|
@@ -3189,6 +3193,7 @@
|
|
} while (c != 0xff && c != EOF);
|
|
do {
|
|
c = str->getChar();
|
|
+ if(c == EOF) return EOF;
|
|
} while (c == 0xff);
|
|
} while (c == 0x00);
|
|
return c;
|