Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(631)

Issue 2422553002: lcms: reject NaN when reading float numbers (Closed)

Created:
4 years, 2 months ago by kcwu
Modified:
4 years, 2 months ago
Reviewers:
dsinclair
CC:
pdfium-reviews_googlegroups.com
Target Ref:
refs/heads/master
Project:
pdfium
Visibility:
Public.

Description

lcms: reject NaN when reading float numbers LerpFloat functions expect input values are normal float. They first clamp values to the range of [0.0, 1.0] and then calculate interpolation with the input values. If the input value is NaN, it will lead to heap buffer overflow because the index to LutTable is calculated based on the said value and fclamp(NaN) is not in expected [0.0, 1.0] range. This patch rejects all NaN values earlier when reading float numbers. So it also changed behavior for cases other than LerpFloat. I think it is okay because NaN doesn't make sense for usual calculations. BUG=654676 Committed: https://pdfium.googlesource.com/pdfium/+/85fcf94eeae589641213c4301bbb16b44b10a282

Patch Set 1 #

Unified diffs Side-by-side diffs Delta from patch set Stats (+16 lines, -0 lines) Patch
A third_party/lcms2-2.6/0010-reject-nan.patch View 1 chunk +13 lines, -0 lines 0 comments Download
M third_party/lcms2-2.6/README.pdfium View 1 chunk +1 line, -0 lines 0 comments Download
M third_party/lcms2-2.6/src/cmsplugin.c View 1 chunk +2 lines, -0 lines 0 comments Download

Messages

Total messages: 7 (3 generated)
kcwu
4 years, 2 months ago (2016-10-14 08:00:07 UTC) #2
dsinclair
lgtm
4 years, 2 months ago (2016-10-17 13:05:49 UTC) #4
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.org/2422553002/1
4 years, 2 months ago (2016-10-17 13:05:57 UTC) #5
commit-bot: I haz the power
4 years, 2 months ago (2016-10-17 13:13:14 UTC) #7
Message was sent while issue was closed.
Committed patchset #1 (id:1) as
https://pdfium.googlesource.com/pdfium/+/85fcf94eeae589641213c4301bbb16b44b10...

Powered by Google App Engine
This is Rietveld 408576698