Attachment #1293 for bug #8632

View | Details | Raw Unified | Return to bug 8632
Collapse All | Expand All




//========================================================================

#include <config.h>
#include <limits.h>

#ifdef USE_GCC_PRAGMAS
#pragma implementation

  int segType;
  GBool haveSIZ, haveCOD, haveQCD, haveSOT;
  Guint precinctSize, style;
  Guint segLen, capabilities, nTiles, comp, i, j, r;

  //----- main header
  haveSIZ = haveCOD = haveQCD = haveSOT = gFalse;

	            / img.xTileSize;
      img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1)
	            / img.yTileSize;
      // check for overflow before allocating memory
      if (img.nXTiles <= 0 || img.nYTiles <= 0 ||
              img.nXTiles >= INT_MAX/img.nYTiles) {
          error(getPos(), "Bad tile count in JPX SIZ marker segment");
          return gFalse;
      }
      nTiles = img.nXTiles * img.nYTiles;
      if (nTiles >= INT_MAX/sizeof(JPXTile)) {
       error(getPos(), "Bad tile count in JPX SIZ marker segment");
       return gFalse;
      }
      img.tiles = (JPXTile *)gmalloc(nTiles * sizeof(JPXTile));
      for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {
	img.tiles[i].tileComps = (JPXTileComp *)gmalloc(img.nComps *
							sizeof(JPXTileComp));

Lines 15-20 Link Here

(-)poppler-0.4.2/poppler/Stream.cc (+36 lines)
15	#include <stdio.h>	15	#include <stdio.h>
16	#include <stdlib.h>	16	#include <stdlib.h>
17	#include <stddef.h>	17	#include <stddef.h>
		18	#include <limits.h>
18	#ifndef WIN32	19	#ifndef WIN32
19	#include <unistd.h>	20	#include <unistd.h>
20	#endif	21	#endif
Lines 420-432 Link Here
420	width = widthA;	421	width = widthA;
421	nComps = nCompsA;	422	nComps = nCompsA;
422	nBits = nBitsA;	423	nBits = nBitsA;
		424	predLine = NULL;
		425	ok = gFalse;
423		426
		427	if (width <= 0 \|\| nComps <= 0 \|\| nBits <= 0 \|\|
		428	nComps >= INT_MAX/nBits \|\|
		429	width >= INT_MAX/nComps/nBits) {
		430	return;
		431	}
424	nVals = width * nComps;	432	nVals = width * nComps;
		433	if (nVals * nBits + 7 <= 0) {
		434	return;
		435	}
425	pixBytes = (nComps * nBits + 7) >> 3;	436	pixBytes = (nComps * nBits + 7) >> 3;
426	rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;	437	rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
		438	if (rowBytes < 0) {
		439	return;
		440	}
427	predLine = (Guchar *)gmalloc(rowBytes);	441	predLine = (Guchar *)gmalloc(rowBytes);
428	memset(predLine, 0, rowBytes);	442	memset(predLine, 0, rowBytes);
429	predIdx = rowBytes;	443	predIdx = rowBytes;
		444
		445	ok = gTrue;
430	}	446	}
431		447
432	StreamPredictor::~StreamPredictor() {	448	StreamPredictor::~StreamPredictor() {
Lines 1020-1025 Link Here
1020	FilterStream(strA) {	1036	FilterStream(strA) {
1021	if (predictor != 1) {	1037	if (predictor != 1) {
1022	pred = new StreamPredictor(this, predictor, columns, colors, bits);	1038	pred = new StreamPredictor(this, predictor, columns, colors, bits);
		1039	if (!pred->isOk()) {
		1040	delete pred;
		1041	pred = NULL;
		1042	}
1023	} else {	1043	} else {
1024	pred = NULL;	1044	pred = NULL;
1025	}	1045	}
Lines 2907-2912 Link Here
2907	height = read16();	2927	height = read16();
2908	width = read16();	2928	width = read16();
2909	numComps = str->getChar();	2929	numComps = str->getChar();
		2930	if (numComps <= 0 \|\| numComps > 4) {
		2931	error(getPos(), "Bad number of components in DCT stream", prec);
		2932	return gFalse;
		2933	}
2910	if (prec != 8) {	2934	if (prec != 8) {
2911	error(getPos(), "Bad DCT precision %d", prec);	2935	error(getPos(), "Bad DCT precision %d", prec);
2912	return gFalse;	2936	return gFalse;
Lines 2933-2938 Link Here
2933	height = read16();	2957	height = read16();
2934	width = read16();	2958	width = read16();
2935	numComps = str->getChar();	2959	numComps = str->getChar();
		2960	if (numComps <= 0 \|\| numComps > 4) {
		2961	error(getPos(), "Bad number of components in DCT stream", prec);
		2962	return gFalse;
		2963	}
2936	if (prec != 8) {	2964	if (prec != 8) {
2937	error(getPos(), "Bad DCT precision %d", prec);	2965	error(getPos(), "Bad DCT precision %d", prec);
2938	return gFalse;	2966	return gFalse;
Lines 2955-2960 Link Here
2955		2983
2956	length = read16() - 2;	2984	length = read16() - 2;
2957	scanInfo.numComps = str->getChar();	2985	scanInfo.numComps = str->getChar();
		2986	if (scanInfo.numComps <= 0 \|\| scanInfo.numComps > 4) {
		2987	error(getPos(), "Bad number of components in DCT stream");
		2988	return gFalse;
		2989	}
2958	--length;	2990	--length;
2959	if (length != 2 * scanInfo.numComps + 3) {	2991	if (length != 2 * scanInfo.numComps + 3) {
2960	error(getPos(), "Bad DCT scan info block");	2992	error(getPos(), "Bad DCT scan info block");
Lines 3268-3273 Link Here
3268	FilterStream(strA) {	3300	FilterStream(strA) {
3269	if (predictor != 1) {	3301	if (predictor != 1) {
3270	pred = new StreamPredictor(this, predictor, columns, colors, bits);	3302	pred = new StreamPredictor(this, predictor, columns, colors, bits);
		3303	if (!pred->isOk()) {
		3304	delete pred;
		3305	pred = NULL;
		3306	}
3271	} else {	3307	} else {
3272	pred = NULL;	3308	pred = NULL;
3273	}	3309	}

Lines 231-236 Link Here

(-)poppler-0.4.2/poppler/Stream.h (+3 lines)
231		231
232	~StreamPredictor();	232	~StreamPredictor();
233		233
		234	GBool isOk() { return ok; }
		235
234	int lookChar();	236	int lookChar();
235	int getChar();	237	int getChar();
236		238
Lines 248-253 Link Here
248	int rowBytes; // bytes per line	250	int rowBytes; // bytes per line
249	Guchar *predLine; // line buffer	251	Guchar *predLine; // line buffer
250	int predIdx; // current index in predLine	252	int predIdx; // current index in predLine
		253	GBool ok;
251	};	254	};
252		255
253	//------------------------------------------------------------------------	256	//------------------------------------------------------------------------

Return to bug 8632

Lines 7-12 Link Here

(-)poppler-0.4.2/poppler/JPXStream.cc (-3 / +14 lines)
7	//========================================================================	7	//========================================================================
8		8
9	#include <config.h>	9	#include <config.h>
		10	#include <limits.h>
10		11
11	#ifdef USE_GCC_PRAGMAS	12	#ifdef USE_GCC_PRAGMAS
12	#pragma implementation	13	#pragma implementation
Lines 666-672 Link Here
666	int segType;	667	int segType;
667	GBool haveSIZ, haveCOD, haveQCD, haveSOT;	668	GBool haveSIZ, haveCOD, haveQCD, haveSOT;
668	Guint precinctSize, style;	669	Guint precinctSize, style;
669	Guint segLen, capabilities, comp, i, j, r;	670	Guint segLen, capabilities, nTiles, comp, i, j, r;
670		671
671	//----- main header	672	//----- main header
672	haveSIZ = haveCOD = haveQCD = haveSOT = gFalse;	673	haveSIZ = haveCOD = haveQCD = haveSOT = gFalse;
Lines 701-708 Link Here
701	/ img.xTileSize;	702	/ img.xTileSize;
702	img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1)	703	img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1)
703	/ img.yTileSize;	704	/ img.yTileSize;
704	img.tiles = (JPXTile )gmalloc(img.nXTiles img.nYTiles *	705	// check for overflow before allocating memory
705	sizeof(JPXTile));	706	if (img.nXTiles <= 0 \|\| img.nYTiles <= 0 \|\|
		707	img.nXTiles >= INT_MAX/img.nYTiles) {
		708	error(getPos(), "Bad tile count in JPX SIZ marker segment");
		709	return gFalse;
		710	}
		711	nTiles = img.nXTiles * img.nYTiles;
		712	if (nTiles >= INT_MAX/sizeof(JPXTile)) {
		713	error(getPos(), "Bad tile count in JPX SIZ marker segment");
		714	return gFalse;
		715	}
		716	img.tiles = (JPXTile )gmalloc(nTiles sizeof(JPXTile));
706	for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {	717	for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {
707	img.tiles[i].tileComps = (JPXTileComp )gmalloc(img.nComps	718	img.tiles[i].tileComps = (JPXTileComp )gmalloc(img.nComps
708	sizeof(JPXTileComp));	719	sizeof(JPXTileComp));