Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(530)

Side by Side Diff: core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp

Issue 1892143003: Prevent a potential OOB read in TranslateImageLine. (Closed) Base URL: https://pdfium.googlesource.com/pdfium.git@master
Patch Set: nits Created 4 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | core/fpdfapi/fpdf_render/fpdf_render_loadimage_embeddertest.cpp » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2014 PDFium Authors. All rights reserved. 1 // Copyright 2014 PDFium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com 5 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
6 6
7 #include "core/fpdfapi/fpdf_render/render_int.h" 7 #include "core/fpdfapi/fpdf_render/render_int.h"
8 8
9 #include <algorithm> 9 #include <algorithm>
10 #include <memory> 10 #include <memory>
(...skipping 552 matching lines...) Expand 10 before | Expand all | Expand 10 after
563 pParams ? pParams->GetIntegerBy("ColorTransform", 1) : 1)); 563 pParams ? pParams->GetIntegerBy("ColorTransform", 1) : 1));
564 if (!m_pDecoder) { 564 if (!m_pDecoder) {
565 FX_BOOL bTransform = FALSE; 565 FX_BOOL bTransform = FALSE;
566 int comps; 566 int comps;
567 int bpc; 567 int bpc;
568 CCodec_JpegModule* pJpegModule = CPDF_ModuleMgr::Get()->GetJpegModule(); 568 CCodec_JpegModule* pJpegModule = CPDF_ModuleMgr::Get()->GetJpegModule();
569 if (pJpegModule->LoadInfo(src_data, src_size, m_Width, m_Height, comps, 569 if (pJpegModule->LoadInfo(src_data, src_size, m_Width, m_Height, comps,
570 bpc, bTransform)) { 570 bpc, bTransform)) {
571 if (m_nComponents != static_cast<uint32_t>(comps)) { 571 if (m_nComponents != static_cast<uint32_t>(comps)) {
572 FX_Free(m_pCompData); 572 FX_Free(m_pCompData);
573 m_pCompData = nullptr;
573 m_nComponents = static_cast<uint32_t>(comps); 574 m_nComponents = static_cast<uint32_t>(comps);
574 if (m_Family == PDFCS_LAB && m_nComponents != 3) { 575 if (m_pColorSpace &&
575 m_pCompData = nullptr; 576 m_pColorSpace->CountComponents() != m_nComponents)
576 return 0; 577 return 0;
577 } 578 if (m_Family == PDFCS_LAB && m_nComponents != 3)
579 return 0;
578 m_pCompData = GetDecodeAndMaskArray(m_bDefaultDecode, m_bColorKey); 580 m_pCompData = GetDecodeAndMaskArray(m_bDefaultDecode, m_bColorKey);
579 if (!m_pCompData) { 581 if (!m_pCompData)
580 return 0; 582 return 0;
581 }
582 } 583 }
583 m_bpc = bpc; 584 m_bpc = bpc;
584 m_pDecoder.reset(CPDF_ModuleMgr::Get()->GetJpegModule()->CreateDecoder( 585 m_pDecoder.reset(CPDF_ModuleMgr::Get()->GetJpegModule()->CreateDecoder(
585 src_data, src_size, m_Width, m_Height, m_nComponents, bTransform)); 586 src_data, src_size, m_Width, m_Height, m_nComponents, bTransform));
586 } 587 }
587 } 588 }
588 } else if (decoder == "FlateDecode") { 589 } else if (decoder == "FlateDecode") {
589 m_pDecoder.reset(FPDFAPI_CreateFlateDecoder( 590 m_pDecoder.reset(FPDFAPI_CreateFlateDecoder(
590 src_data, src_size, m_Width, m_Height, m_nComponents, m_bpc, pParams)); 591 src_data, src_size, m_Width, m_Height, m_nComponents, m_bpc, pParams));
591 } else if (decoder == "JPXDecode") { 592 } else if (decoder == "JPXDecode") {
(...skipping 979 matching lines...) Expand 10 before | Expand all | Expand 10 after
1571 IFX_Pause* pPause) { 1572 IFX_Pause* pPause) {
1572 return LoadHandle->Continue(pPause); 1573 return LoadHandle->Continue(pPause);
1573 } 1574 }
1574 1575
1575 CPDF_ImageLoader::~CPDF_ImageLoader() { 1576 CPDF_ImageLoader::~CPDF_ImageLoader() {
1576 if (!m_bCached) { 1577 if (!m_bCached) {
1577 delete m_pBitmap; 1578 delete m_pBitmap;
1578 delete m_pMask; 1579 delete m_pMask;
1579 } 1580 }
1580 } 1581 }
OLDNEW
« no previous file with comments | « no previous file | core/fpdfapi/fpdf_render/fpdf_render_loadimage_embeddertest.cpp » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698