Fix the JBIG2 decoding regressions from commit bc4b82e and 8a9ce57.

Fix the JBIG2 decoding regressions from commit bc4b82e and 8a9ce57.

BUG=566063
R=tsepez@chromium.org

Committed: https://pdfium.googlesource.com/pdfium/+/20c8a9a66ea710b96493c9048fb65753e68b48fc

[Lei Zhang, 2015-12-18 23:03:04]

thestig@chromium.org changed reviewers:
+ tsepez@chromium.org

[Lei Zhang, 2015-12-18 23:07:30]

Actually, hold off on this for a bit. Bug 482639 seemes to have come back.

[Tom Sepez, 2015-12-18 23:10:50]

Signed comparisons, I presume? LGTM

https://codereview.chromium.org/1534323002/diff/1/core/src/fxcodec/jbig2/JBig...
File core/src/fxcodec/jbig2/JBig2_HuffmanTable.cpp (right):

https://codereview.chromium.org/1534323002/diff/1/core/src/fxcodec/jbig2/JBig...
core/src/fxcodec/jbig2/JBig2_HuffmanTable.cpp:110: const int low =
static_cast<int>(HTLOW);
do you want int32_t here?

[Lei Zhang, 2015-12-18 23:20:26]

The PDF from bug 482639 has 1.6 billion entries. It did run to completion and
did not crash, so n/m.

On 2015/12/18 23:10:50, Tom Sepez wrote:
> Signed comparisons, I presume? LGTM

Yes, the low value can be negative for example. When converted to unsigned, it
becomes a large number and the HTLOW > HTHIGH comparison triggers.

>
https://codereview.chromium.org/1534323002/diff/1/core/src/fxcodec/jbig2/JBig...
> File core/src/fxcodec/jbig2/JBig2_HuffmanTable.cpp (right):
> 
>
https://codereview.chromium.org/1534323002/diff/1/core/src/fxcodec/jbig2/JBig...
> core/src/fxcodec/jbig2/JBig2_HuffmanTable.cpp:110: const int low =
> static_cast<int>(HTLOW);
> do you want int32_t here?

RANGELOW is a container of ints.

[Lei Zhang, 2015-12-19 00:04:56]

Description was changed from

==========
Fix the JBIG2 decoding regressions from commit bc4b82e and 8a9ce57.

BUG=566063
==========

to

==========
Fix the JBIG2 decoding regressions from commit bc4b82e and 8a9ce57.

BUG=566063
R=tsepez@chromium.org

Committed:
https://pdfium.googlesource.com/pdfium/+/20c8a9a66ea710b96493c9048fb65753e68b...
==========

[Lei Zhang, 2015-12-19 00:04:58]

Committed patchset #1 (id:1) manually as
20c8a9a66ea710b96493c9048fb65753e68b48fc (presubmit successful).