Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(360)

Unified Diff: third_party/libopenjpeg20/0009-opj_pi_next.patch

Issue 1590593002: Merge to XFA: openjpeg: Fix potential bad precno value in opj_pi_next* functions. (Closed) Base URL: https://pdfium.googlesource.com/pdfium.git@xfa
Patch Set: Created 4 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | third_party/libopenjpeg20/README.pdfium » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: third_party/libopenjpeg20/0009-opj_pi_next.patch
diff --git a/third_party/libopenjpeg20/0009-opj_pi_next.patch b/third_party/libopenjpeg20/0009-opj_pi_next.patch
new file mode 100644
index 0000000000000000000000000000000000000000..a7701f0d05a8bd2e7ab1af7ea8b3e4addf4ae1f6
--- /dev/null
+++ b/third_party/libopenjpeg20/0009-opj_pi_next.patch
@@ -0,0 +1,34 @@
+diff --git a/third_party/libopenjpeg20/pi.c b/third_party/libopenjpeg20/pi.c
+index 06f1e41..462e07c 100644
+--- a/third_party/libopenjpeg20/pi.c
++++ b/third_party/libopenjpeg20/pi.c
+@@ -377,6 +377,9 @@ if (!pi->tp_on){
+ prcj = opj_int_floordivpow2(opj_int_ceildiv(pi->y, (OPJ_INT32)(comp->dy << levelno)), (OPJ_INT32)res->pdy)
+ - opj_int_floordivpow2(try0, (OPJ_INT32)res->pdy);
+ pi->precno = (OPJ_UINT32)(prci + prcj * (OPJ_INT32)res->pw);
++ if (pi->precno >= res->pw * res->ph) {
++ return OPJ_FALSE;
++ }
+ for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) {
+ index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p;
+ if (!pi->include[index]) {
+@@ -458,6 +461,9 @@ static OPJ_BOOL opj_pi_next_pcrl(opj_pi_iterator_t * pi) {
+ prcj = opj_int_floordivpow2(opj_int_ceildiv(pi->y, (OPJ_INT32)(comp->dy << levelno)), (OPJ_INT32)res->pdy)
+ - opj_int_floordivpow2(try0, (OPJ_INT32)res->pdy);
+ pi->precno = (OPJ_UINT32)(prci + prcj * (OPJ_INT32)res->pw);
++ if (pi->precno >= res->pw * res->ph) {
++ return OPJ_FALSE;
++ }
+ for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) {
+ index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p;
+ if (!pi->include[index]) {
+@@ -537,6 +543,9 @@ static OPJ_BOOL opj_pi_next_cprl(opj_pi_iterator_t * pi) {
+ prcj = opj_int_floordivpow2(opj_int_ceildiv(pi->y, (OPJ_INT32)(comp->dy << levelno)), (OPJ_INT32)res->pdy)
+ - opj_int_floordivpow2(try0, (OPJ_INT32)res->pdy);
+ pi->precno = (OPJ_UINT32)(prci + prcj * (OPJ_INT32)res->pw);
++ if (pi->precno >= res->pw * res->ph) {
++ return OPJ_FALSE;
++ }
+ for (pi->layno = pi->poc.layno0; pi->layno < pi->poc.layno1; pi->layno++) {
+ index = pi->layno * pi->step_l + pi->resno * pi->step_r + pi->compno * pi->step_c + pi->precno * pi->step_p;
+ if (!pi->include[index]) {
« no previous file with comments | « no previous file | third_party/libopenjpeg20/README.pdfium » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698