Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(1608)

Unified Diff: core/fxcodec/codec/fx_codec_jpx_opj.cpp

Issue 1934483002: Avoid nullptr dereferences in sycc444_to_rgb(). (Closed) Base URL: https://pdfium.googlesource.com/pdfium@master
Patch Set: Created 4 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « no previous file | no next file » | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: core/fxcodec/codec/fx_codec_jpx_opj.cpp
diff --git a/core/fxcodec/codec/fx_codec_jpx_opj.cpp b/core/fxcodec/codec/fx_codec_jpx_opj.cpp
index 85b0b767acbcb09db45d7d1081b6c3f44c8152bf..a0f2e65c7533b89e765512f27bd74ab331fd5b9a 100644
--- a/core/fxcodec/codec/fx_codec_jpx_opj.cpp
+++ b/core/fxcodec/codec/fx_codec_jpx_opj.cpp
@@ -169,14 +169,15 @@ static void sycc_to_rgb(int offset,
}
*out_b = b;
}
+
static void sycc444_to_rgb(opj_image_t* img) {
int prec = img->comps[0].prec;
int offset = 1 << (prec - 1);
int upb = (1 << prec) - 1;
OPJ_UINT32 maxw =
- std::min(std::min(img->comps[0].w, img->comps[1].w), img->comps[2].w);
+ std::min({img->comps[0].w, img->comps[1].w, img->comps[2].w});
OPJ_UINT32 maxh =
- std::min(std::min(img->comps[0].h, img->comps[1].h), img->comps[2].h);
+ std::min({img->comps[0].h, img->comps[1].h, img->comps[2].h});
FX_SAFE_SIZE_T max_size = maxw;
max_size *= maxh;
if (!max_size.IsValid())
@@ -185,10 +186,15 @@ static void sycc444_to_rgb(opj_image_t* img) {
const int* y = img->comps[0].data;
const int* cb = img->comps[1].data;
const int* cr = img->comps[2].data;
- int *d0, *d1, *d2, *r, *g, *b;
- d0 = r = FX_Alloc(int, max_size.ValueOrDie());
- d1 = g = FX_Alloc(int, max_size.ValueOrDie());
- d2 = b = FX_Alloc(int, max_size.ValueOrDie());
+ if (!y || !cb || !cr)
+ return;
+
+ int* r = FX_Alloc(int, max_size.ValueOrDie());
+ int* g = FX_Alloc(int, max_size.ValueOrDie());
+ int* b = FX_Alloc(int, max_size.ValueOrDie());
+ int* d0 = r;
+ int* d1 = g;
+ int* d2 = b;
for (size_t i = 0; i < max_size.ValueOrDie(); ++i) {
sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
++y;
@@ -199,12 +205,13 @@ static void sycc444_to_rgb(opj_image_t* img) {
++b;
}
FX_Free(img->comps[0].data);
- img->comps[0].data = d0;
FX_Free(img->comps[1].data);
- img->comps[1].data = d1;
FX_Free(img->comps[2].data);
+ img->comps[0].data = d0;
+ img->comps[1].data = d1;
img->comps[2].data = d2;
}
+
static bool sycc420_422_size_is_valid(opj_image_t* img) {
return (img && img->comps[0].w != std::numeric_limits<OPJ_UINT32>::max() &&
(img->comps[0].w + 1) / 2 == img->comps[1].w &&
« no previous file with comments | « no previous file | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698