OLD | NEW |
---|---|
1 // Copyright 2014 PDFium Authors. All rights reserved. | 1 // Copyright 2014 PDFium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com | 5 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com |
6 | 6 |
7 #include "core/fpdfapi/fpdf_parser/include/fpdf_parser_decode.h" | 7 #include "core/fpdfapi/fpdf_parser/include/fpdf_parser_decode.h" |
8 | 8 |
9 #include <limits.h> | 9 #include <limits.h> |
10 | |
11 #include <algorithm> | |
10 #include <utility> | 12 #include <utility> |
11 #include <vector> | 13 #include <vector> |
12 | 14 |
13 #include "core/fpdfapi/fpdf_parser/fpdf_parser_utility.h" | 15 #include "core/fpdfapi/fpdf_parser/fpdf_parser_utility.h" |
14 #include "core/fpdfapi/fpdf_parser/include/cpdf_array.h" | 16 #include "core/fpdfapi/fpdf_parser/include/cpdf_array.h" |
15 #include "core/fpdfapi/fpdf_parser/include/cpdf_dictionary.h" | 17 #include "core/fpdfapi/fpdf_parser/include/cpdf_dictionary.h" |
16 #include "core/fpdfapi/include/cpdf_modulemgr.h" | 18 #include "core/fpdfapi/include/cpdf_modulemgr.h" |
17 #include "core/fxcodec/include/fx_codec.h" | 19 #include "core/fxcodec/include/fx_codec.h" |
18 #include "core/fxcrt/include/fx_ext.h" | 20 #include "core/fxcrt/include/fx_ext.h" |
19 #include "third_party/base/stl_util.h" | 21 #include "third_party/base/stl_util.h" |
(...skipping 147 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
167 } | 169 } |
168 | 170 |
169 uint32_t RunLengthDecode(const uint8_t* src_buf, | 171 uint32_t RunLengthDecode(const uint8_t* src_buf, |
170 uint32_t src_size, | 172 uint32_t src_size, |
171 uint8_t*& dest_buf, | 173 uint8_t*& dest_buf, |
172 uint32_t& dest_size) { | 174 uint32_t& dest_size) { |
173 uint32_t i = 0; | 175 uint32_t i = 0; |
174 uint32_t old; | 176 uint32_t old; |
175 dest_size = 0; | 177 dest_size = 0; |
176 while (i < src_size) { | 178 while (i < src_size) { |
179 if (src_buf[i] == 128) | |
180 break; | |
181 | |
177 if (src_buf[i] < 128) { | 182 if (src_buf[i] < 128) { |
178 old = dest_size; | 183 old = dest_size; |
179 dest_size += src_buf[i] + 1; | 184 dest_size += src_buf[i] + 1; |
180 if (dest_size < old) | 185 if (dest_size < old) |
Tom Sepez
2016/09/23 21:55:48
note: OK, unsigned type.
| |
181 return FX_INVALID_OFFSET; | 186 return FX_INVALID_OFFSET; |
182 i += src_buf[i] + 2; | 187 i += src_buf[i] + 2; |
Tom Sepez
2016/09/23 21:55:48
note: there's one value where this can overflow, e
Lei Zhang
2016/09/26 22:50:59
Sure.
| |
183 } else if (src_buf[i] > 128) { | 188 } else { |
184 old = dest_size; | 189 old = dest_size; |
185 dest_size += 257 - src_buf[i]; | 190 dest_size += 257 - src_buf[i]; |
186 if (dest_size < old) | 191 if (dest_size < old) |
187 return FX_INVALID_OFFSET; | 192 return FX_INVALID_OFFSET; |
188 i += 2; | 193 i += 2; |
189 } else { | |
190 break; | |
191 } | 194 } |
192 } | 195 } |
193 if (dest_size >= _STREAM_MAX_SIZE_) | 196 if (dest_size >= _STREAM_MAX_SIZE_) |
194 return FX_INVALID_OFFSET; | 197 return FX_INVALID_OFFSET; |
195 dest_buf = FX_Alloc(uint8_t, dest_size); | 198 dest_buf = FX_Alloc(uint8_t, dest_size); |
196 i = 0; | 199 i = 0; |
197 int dest_count = 0; | 200 int dest_count = 0; |
198 while (i < src_size) { | 201 while (i < src_size) { |
202 if (src_buf[i] == 128) | |
203 break; | |
204 | |
199 if (src_buf[i] < 128) { | 205 if (src_buf[i] < 128) { |
200 uint32_t copy_len = src_buf[i] + 1; | 206 uint32_t copy_len = src_buf[i] + 1; |
201 uint32_t buf_left = src_size - i - 1; | 207 uint32_t buf_left = src_size - i - 1; |
202 if (buf_left < copy_len) { | 208 if (buf_left < copy_len) { |
203 uint32_t delta = copy_len - buf_left; | 209 uint32_t delta = copy_len - buf_left; |
204 copy_len = buf_left; | 210 copy_len = buf_left; |
205 FXSYS_memset(dest_buf + dest_count + copy_len, '\0', delta); | 211 FXSYS_memset(dest_buf + dest_count + copy_len, '\0', delta); |
206 } | 212 } |
207 FXSYS_memcpy(dest_buf + dest_count, src_buf + i + 1, copy_len); | 213 FXSYS_memcpy(dest_buf + dest_count, src_buf + i + 1, copy_len); |
208 dest_count += src_buf[i] + 1; | 214 dest_count += src_buf[i] + 1; |
209 i += src_buf[i] + 2; | 215 i += src_buf[i] + 2; |
210 } else if (src_buf[i] > 128) { | 216 } else { |
211 int fill = 0; | 217 int fill = 0; |
212 if (i < src_size - 1) { | 218 if (i < src_size - 1) { |
213 fill = src_buf[i + 1]; | 219 fill = src_buf[i + 1]; |
214 } | 220 } |
215 FXSYS_memset(dest_buf + dest_count, fill, 257 - src_buf[i]); | 221 FXSYS_memset(dest_buf + dest_count, fill, 257 - src_buf[i]); |
216 dest_count += 257 - src_buf[i]; | 222 dest_count += 257 - src_buf[i]; |
217 i += 2; | 223 i += 2; |
218 } else { | |
219 break; | |
220 } | 224 } |
221 } | 225 } |
222 uint32_t ret = i + 1; | 226 |
223 if (ret > src_size) { | 227 return std::min(i + 1, src_size); |
224 ret = src_size; | |
225 } | |
226 return ret; | |
227 } | 228 } |
228 | 229 |
229 CCodec_ScanlineDecoder* FPDFAPI_CreateFaxDecoder( | 230 CCodec_ScanlineDecoder* FPDFAPI_CreateFaxDecoder( |
230 const uint8_t* src_buf, | 231 const uint8_t* src_buf, |
231 uint32_t src_size, | 232 uint32_t src_size, |
232 int width, | 233 int width, |
233 int height, | 234 int height, |
234 const CPDF_Dictionary* pParams) { | 235 const CPDF_Dictionary* pParams) { |
235 int K = 0; | 236 int K = 0; |
236 FX_BOOL EndOfLine = FALSE; | 237 bool EndOfLine = false; |
237 FX_BOOL ByteAlign = FALSE; | 238 bool ByteAlign = false; |
238 FX_BOOL BlackIs1 = FALSE; | 239 bool BlackIs1 = false; |
239 int Columns = 1728; | 240 int Columns = 1728; |
240 int Rows = 0; | 241 int Rows = 0; |
241 if (pParams) { | 242 if (pParams) { |
242 K = pParams->GetIntegerFor("K"); | 243 K = pParams->GetIntegerFor("K"); |
243 EndOfLine = pParams->GetIntegerFor("EndOfLine"); | 244 EndOfLine = !!pParams->GetIntegerFor("EndOfLine"); |
Tom Sepez
2016/09/23 21:55:48
Yay, another not assigning 0 or 1 to FX_BOOL !!!
Lei Zhang
2016/09/26 22:50:59
Acknowledged.
| |
244 ByteAlign = pParams->GetIntegerFor("EncodedByteAlign"); | 245 ByteAlign = !!pParams->GetIntegerFor("EncodedByteAlign"); |
245 BlackIs1 = pParams->GetIntegerFor("BlackIs1"); | 246 BlackIs1 = !!pParams->GetIntegerFor("BlackIs1"); |
246 Columns = pParams->GetIntegerFor("Columns", 1728); | 247 Columns = pParams->GetIntegerFor("Columns", 1728); |
247 Rows = pParams->GetIntegerFor("Rows"); | 248 Rows = pParams->GetIntegerFor("Rows"); |
248 if (Rows > USHRT_MAX) { | 249 if (Rows > USHRT_MAX) { |
249 Rows = 0; | 250 Rows = 0; |
250 } | 251 } |
251 } | 252 } |
252 return CPDF_ModuleMgr::Get()->GetFaxModule()->CreateDecoder( | 253 return CPDF_ModuleMgr::Get()->GetFaxModule()->CreateDecoder( |
253 src_buf, src_size, width, height, K, EndOfLine, ByteAlign, BlackIs1, | 254 src_buf, src_size, width, height, K, EndOfLine, ByteAlign, BlackIs1, |
254 Columns, Rows); | 255 Columns, Rows); |
255 } | 256 } |
(...skipping 313 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
569 uint32_t src_size, | 570 uint32_t src_size, |
570 uint8_t*& dest_buf, | 571 uint8_t*& dest_buf, |
571 uint32_t& dest_size) { | 572 uint32_t& dest_size) { |
572 CCodec_ModuleMgr* pEncoders = CPDF_ModuleMgr::Get()->GetCodecModule(); | 573 CCodec_ModuleMgr* pEncoders = CPDF_ModuleMgr::Get()->GetCodecModule(); |
573 if (pEncoders) { | 574 if (pEncoders) { |
574 return pEncoders->GetFlateModule()->FlateOrLZWDecode( | 575 return pEncoders->GetFlateModule()->FlateOrLZWDecode( |
575 FALSE, src_buf, src_size, FALSE, 0, 0, 0, 0, 0, dest_buf, dest_size); | 576 FALSE, src_buf, src_size, FALSE, 0, 0, 0, 0, 0, dest_buf, dest_size); |
576 } | 577 } |
577 return 0; | 578 return 0; |
578 } | 579 } |
OLD | NEW |