Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(2261)

Unified Diff: core/fxcodec/jbig2/JBig2_GrdProc.cpp

Issue 2202013002: Bound total pixels in JBig2 images to avoid overflows later. (Closed) Base URL: https://pdfium.googlesource.com/pdfium.git@master
Patch Set: Add tests Created 4 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: core/fxcodec/jbig2/JBig2_GrdProc.cpp
diff --git a/core/fxcodec/jbig2/JBig2_GrdProc.cpp b/core/fxcodec/jbig2/JBig2_GrdProc.cpp
index 9527c1eaf88a56733313e4470410d431ebd76586..b692909c01b6bd3469a9f6fce95f4d124a8d327f 100644
--- a/core/fxcodec/jbig2/JBig2_GrdProc.cpp
+++ b/core/fxcodec/jbig2/JBig2_GrdProc.cpp
@@ -71,7 +71,7 @@ CJBig2_Image* CJBig2_GRDProc::decode_Arith_Template0_opt3(
FX_BOOL LTP = FALSE;
uint8_t* pLine = GBREG->m_pData;
- int32_t nStride = GBREG->m_nStride;
+ int32_t nStride = GBREG->stride();
int32_t nStride2 = nStride << 1;
int32_t nLineBytes = ((GBW + 7) >> 3) - 1;
int32_t nBitsLeft = GBW - (nLineBytes << 3);
@@ -197,7 +197,7 @@ CJBig2_Image* CJBig2_GRDProc::decode_Arith_Template1_opt3(
FX_BOOL LTP = FALSE;
uint8_t* pLine = GBREG->m_pData;
- int32_t nStride = GBREG->m_nStride;
+ int32_t nStride = GBREG->stride();
int32_t nStride2 = nStride << 1;
int32_t nLineBytes = ((GBW + 7) >> 3) - 1;
int32_t nBitsLeft = GBW - (nLineBytes << 3);
@@ -320,7 +320,7 @@ CJBig2_Image* CJBig2_GRDProc::decode_Arith_Template2_opt3(
FX_BOOL LTP = FALSE;
uint8_t* pLine = GBREG->m_pData;
- int32_t nStride = GBREG->m_nStride;
+ int32_t nStride = GBREG->stride();
int32_t nStride2 = nStride << 1;
int32_t nLineBytes = ((GBW + 7) >> 3) - 1;
int32_t nBitsLeft = GBW - (nLineBytes << 3);
@@ -441,7 +441,7 @@ CJBig2_Image* CJBig2_GRDProc::decode_Arith_Template3_opt3(
FX_BOOL LTP = FALSE;
uint8_t* pLine = GBREG->m_pData;
- int32_t nStride = GBREG->m_nStride;
+ int32_t nStride = GBREG->stride();
int32_t nLineBytes = ((GBW + 7) >> 3) - 1;
int32_t nBitsLeft = GBW - (nLineBytes << 3);
for (uint32_t h = 0; h < GBH; h++) {
@@ -602,7 +602,7 @@ FXCODEC_STATUS CJBig2_GRDProc::decode_Arith(IFX_Pause* pPause) {
}
}
m_ReplaceRect.left = 0;
- m_ReplaceRect.right = pImage->m_nWidth;
+ m_ReplaceRect.right = pImage->width();
m_ReplaceRect.top = iline;
m_ReplaceRect.bottom = m_loopIndex;
if (m_ProssiveStatus == FXCODEC_STATUS_DECODE_FINISH) {
@@ -624,9 +624,9 @@ FXCODEC_STATUS CJBig2_GRDProc::Start_decode_MMR(CJBig2_Image** pImage,
}
bitpos = (int)pStream->getBitPos();
FaxG4Decode(pStream->getBuf(), pStream->getLength(), &bitpos,
- (*pImage)->m_pData, GBW, GBH, (*pImage)->m_nStride);
+ (*pImage)->m_pData, GBW, GBH, (*pImage)->stride());
pStream->setBitPos(bitpos);
- for (i = 0; (uint32_t)i < (*pImage)->m_nStride * GBH; i++) {
+ for (i = 0; (uint32_t)i < (*pImage)->stride() * GBH; i++) {
(*pImage)->m_pData[i] = ~(*pImage)->m_pData[i];
}
m_ProssiveStatus = FXCODEC_STATUS_DECODE_FINISH;
@@ -653,7 +653,7 @@ FXCODEC_STATUS CJBig2_GRDProc::decode_Arith_Template0_opt3(
if (!m_pLine) {
m_pLine = pImage->m_pData;
}
- int32_t nStride = pImage->m_nStride;
+ int32_t nStride = pImage->stride();
int32_t nStride2 = nStride << 1;
int32_t nLineBytes = ((GBW + 7) >> 3) - 1;
int32_t nBitsLeft = GBW - (nLineBytes << 3);
@@ -791,7 +791,7 @@ FXCODEC_STATUS CJBig2_GRDProc::decode_Arith_Template1_opt3(
if (!m_pLine) {
m_pLine = pImage->m_pData;
}
- int32_t nStride = pImage->m_nStride;
+ int32_t nStride = pImage->stride();
int32_t nStride2 = nStride << 1;
int32_t nLineBytes = ((GBW + 7) >> 3) - 1;
int32_t nBitsLeft = GBW - (nLineBytes << 3);
@@ -924,7 +924,7 @@ FXCODEC_STATUS CJBig2_GRDProc::decode_Arith_Template2_opt3(
if (!m_pLine) {
m_pLine = pImage->m_pData;
}
- int32_t nStride = pImage->m_nStride;
+ int32_t nStride = pImage->stride();
int32_t nStride2 = nStride << 1;
int32_t nLineBytes = ((GBW + 7) >> 3) - 1;
int32_t nBitsLeft = GBW - (nLineBytes << 3);
@@ -1057,7 +1057,7 @@ FXCODEC_STATUS CJBig2_GRDProc::decode_Arith_Template3_opt3(
if (!m_pLine)
m_pLine = pImage->m_pData;
- int32_t nStride = pImage->m_nStride;
+ int32_t nStride = pImage->stride();
int32_t nLineBytes = ((GBW + 7) >> 3) - 1;
int32_t nBitsLeft = GBW - (nLineBytes << 3);
for (; m_loopIndex < GBH; m_loopIndex++) {

Powered by Google App Engine
This is Rietveld 408576698