Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(2247)

Unified Diff: core/src/fxcodec/jbig2/JBig2_ArithDecoder.h

Issue 1135133002: Fix a heap overflow in CJBig2_Context::parseSymbolDict (Closed) Base URL: https://pdfium.googlesource.com/pdfium@2357
Patch Set: Created 5 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | core/src/fxcodec/jbig2/JBig2_ArithQe.h » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: core/src/fxcodec/jbig2/JBig2_ArithDecoder.h
diff --git a/core/src/fxcodec/jbig2/JBig2_ArithDecoder.h b/core/src/fxcodec/jbig2/JBig2_ArithDecoder.h
index 214688d3b2eea9670ab7f828642dc63ed8245412..33bbe39d0d34ac536b7e497ef9c99b7db708a843 100644
--- a/core/src/fxcodec/jbig2/JBig2_ArithDecoder.h
+++ b/core/src/fxcodec/jbig2/JBig2_ArithDecoder.h
@@ -72,6 +72,10 @@ inline void CJBig2_ArithDecoder::BYTEIN()
}
inline int CJBig2_ArithDecoder::DECODE(JBig2ArithCtx *pCX)
{
+ if (!pCX || pCX->I >= JBIG2_QE_NUM) {
+ return 0;
+ }
+
int D;
const JBig2ArithQe * qe = &QeTable[pCX->I];
A = A - qe->Qe;
« no previous file with comments | « no previous file | core/src/fxcodec/jbig2/JBig2_ArithQe.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698