Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(63)

Side by Side Diff: third_party/libopenjpeg20/0021-tcd_init_tile_negative.patch

Issue 2223303002: openjpeg: Prevent negative x, y values in opj_tcd_init_tile (Closed) Base URL: https://pdfium.googlesource.com/pdfium.git@master
Patch Set: Created 4 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « no previous file | third_party/libopenjpeg20/README.pdfium » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
(Empty)
1 diff --git a/third_party/libopenjpeg20/tcd.c b/third_party/libopenjpeg20/tcd.c
2 index 9270efe..06eee4e 100644
3 --- a/third_party/libopenjpeg20/tcd.c
4 +++ b/third_party/libopenjpeg20/tcd.c
5 @@ -706,9 +706,16 @@ static INLINE OPJ_BOOL opj_tcd_init_tile(opj_tcd_t *p_tcd, OPJ_UINT32 p_tile_no,
6 l_tx0 = l_cp->tx0 + p * l_cp->tdx; /* can't be greater than l_image->x1 so won't overflow */
7 l_tile->x0 = (OPJ_INT32)opj_uint_max(l_tx0, l_image->x0);
8 l_tile->x1 = (OPJ_INT32)opj_uint_min(opj_uint_adds(l_tx0, l_cp->tdx), l_ image->x1);
9 + if (l_tile->x0 < 0 || l_tile->x1 < 0) {
10 + return OPJ_FALSE;
11 + }
12 +
13 l_ty0 = l_cp->ty0 + q * l_cp->tdy; /* can't be greater than l_image->y1 so won't overflow */
14 l_tile->y0 = (OPJ_INT32)opj_uint_max(l_ty0, l_image->y0);
15 l_tile->y1 = (OPJ_INT32)opj_uint_min(opj_uint_adds(l_ty0, l_cp->tdy), l_ image->y1);
16 + if (l_tile->y0 < 0 || l_tile->y1 < 0) {
17 + return OPJ_FALSE;
18 + }
19
20 /* testcase 1888.pdf.asan.35.988 */
21 if (l_tccp->numresolutions == 0) {
OLDNEW
« no previous file with comments | « no previous file | third_party/libopenjpeg20/README.pdfium » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698