| OLD | NEW |
| 1 // Copyright 2016 PDFium Authors. All rights reserved. | 1 // Copyright 2016 PDFium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com | 5 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com |
| 6 | 6 |
| 7 #include "core/fpdfapi/page/cpdf_streamparser.h" | 7 #include "core/fpdfapi/page/cpdf_streamparser.h" |
| 8 | 8 |
| 9 #include <limits.h> | 9 #include <limits.h> |
| 10 | 10 |
| (...skipping 160 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 171 } else { | 171 } else { |
| 172 if (width > INT_MAX - 7) | 172 if (width > INT_MAX - 7) |
| 173 return nullptr; | 173 return nullptr; |
| 174 | 174 |
| 175 OrigSize = ((width + 7) / 8); | 175 OrigSize = ((width + 7) / 8); |
| 176 } | 176 } |
| 177 if (height && OrigSize > INT_MAX / height) | 177 if (height && OrigSize > INT_MAX / height) |
| 178 return nullptr; | 178 return nullptr; |
| 179 | 179 |
| 180 OrigSize *= height; | 180 OrigSize *= height; |
| 181 uint8_t* pData = nullptr; | 181 std::unique_ptr<uint8_t, FxFreeDeleter> pData; |
| 182 uint32_t dwStreamSize; | 182 uint32_t dwStreamSize; |
| 183 if (Decoder.IsEmpty()) { | 183 if (Decoder.IsEmpty()) { |
| 184 if (OrigSize > m_Size - m_Pos) | 184 if (OrigSize > m_Size - m_Pos) |
| 185 OrigSize = m_Size - m_Pos; | 185 OrigSize = m_Size - m_Pos; |
| 186 pData = FX_Alloc(uint8_t, OrigSize); | 186 pData.reset(FX_Alloc(uint8_t, OrigSize)); |
| 187 FXSYS_memcpy(pData, m_pBuf + m_Pos, OrigSize); | 187 FXSYS_memcpy(pData.get(), m_pBuf + m_Pos, OrigSize); |
| 188 dwStreamSize = OrigSize; | 188 dwStreamSize = OrigSize; |
| 189 m_Pos += OrigSize; | 189 m_Pos += OrigSize; |
| 190 } else { | 190 } else { |
| 191 uint8_t* pIgnore; |
| 191 uint32_t dwDestSize = OrigSize; | 192 uint32_t dwDestSize = OrigSize; |
| 192 dwStreamSize = | 193 dwStreamSize = |
| 193 PDF_DecodeInlineStream(m_pBuf + m_Pos, m_Size - m_Pos, width, height, | 194 PDF_DecodeInlineStream(m_pBuf + m_Pos, m_Size - m_Pos, width, height, |
| 194 Decoder, pParam, pData, dwDestSize); | 195 Decoder, pParam, pIgnore, dwDestSize); |
| 195 FX_Free(pData); | 196 FX_Free(pIgnore); |
| 196 if (static_cast<int>(dwStreamSize) < 0) | 197 if (static_cast<int>(dwStreamSize) < 0) |
| 197 return nullptr; | 198 return nullptr; |
| 198 | 199 |
| 199 uint32_t dwSavePos = m_Pos; | 200 uint32_t dwSavePos = m_Pos; |
| 200 m_Pos += dwStreamSize; | 201 m_Pos += dwStreamSize; |
| 201 while (1) { | 202 while (1) { |
| 202 uint32_t dwPrevPos = m_Pos; | 203 uint32_t dwPrevPos = m_Pos; |
| 203 CPDF_StreamParser::SyntaxType type = ParseNextElement(); | 204 CPDF_StreamParser::SyntaxType type = ParseNextElement(); |
| 204 if (type == CPDF_StreamParser::EndOfData) | 205 if (type == CPDF_StreamParser::EndOfData) |
| 205 break; | 206 break; |
| 206 | 207 |
| 207 if (type != CPDF_StreamParser::Keyword) { | 208 if (type != CPDF_StreamParser::Keyword) { |
| 208 dwStreamSize += m_Pos - dwPrevPos; | 209 dwStreamSize += m_Pos - dwPrevPos; |
| 209 continue; | 210 continue; |
| 210 } | 211 } |
| 211 if (GetWordSize() == 2 && GetWordBuf()[0] == 'E' && | 212 if (GetWordSize() == 2 && GetWordBuf()[0] == 'E' && |
| 212 GetWordBuf()[1] == 'I') { | 213 GetWordBuf()[1] == 'I') { |
| 213 m_Pos = dwPrevPos; | 214 m_Pos = dwPrevPos; |
| 214 break; | 215 break; |
| 215 } | 216 } |
| 216 dwStreamSize += m_Pos - dwPrevPos; | 217 dwStreamSize += m_Pos - dwPrevPos; |
| 217 } | 218 } |
| 218 m_Pos = dwSavePos; | 219 m_Pos = dwSavePos; |
| 219 pData = FX_Alloc(uint8_t, dwStreamSize); | 220 pData.reset(FX_Alloc(uint8_t, dwStreamSize)); |
| 220 FXSYS_memcpy(pData, m_pBuf + m_Pos, dwStreamSize); | 221 FXSYS_memcpy(pData.get(), m_pBuf + m_Pos, dwStreamSize); |
| 221 m_Pos += dwStreamSize; | 222 m_Pos += dwStreamSize; |
| 222 } | 223 } |
| 223 pDict->SetNewFor<CPDF_Number>("Length", (int)dwStreamSize); | 224 pDict->SetNewFor<CPDF_Number>("Length", (int)dwStreamSize); |
| 224 return pdfium::MakeUnique<CPDF_Stream>(pData, dwStreamSize, std::move(pDict)); | 225 return pdfium::MakeUnique<CPDF_Stream>(std::move(pData), dwStreamSize, |
| 226 std::move(pDict)); |
| 225 } | 227 } |
| 226 | 228 |
| 227 CPDF_StreamParser::SyntaxType CPDF_StreamParser::ParseNextElement() { | 229 CPDF_StreamParser::SyntaxType CPDF_StreamParser::ParseNextElement() { |
| 228 m_pLastObj.reset(); | 230 m_pLastObj.reset(); |
| 229 m_WordSize = 0; | 231 m_WordSize = 0; |
| 230 if (!PositionIsInBounds()) | 232 if (!PositionIsInBounds()) |
| 231 return EndOfData; | 233 return EndOfData; |
| 232 | 234 |
| 233 int ch = m_pBuf[m_Pos++]; | 235 int ch = m_pBuf[m_Pos++]; |
| 234 while (1) { | 236 while (1) { |
| (...skipping 360 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 595 | 597 |
| 596 if (buf.GetLength() > kMaxStringLength) | 598 if (buf.GetLength() > kMaxStringLength) |
| 597 return CFX_ByteString(buf.GetBuffer(), kMaxStringLength); | 599 return CFX_ByteString(buf.GetBuffer(), kMaxStringLength); |
| 598 | 600 |
| 599 return buf.MakeString(); | 601 return buf.MakeString(); |
| 600 } | 602 } |
| 601 | 603 |
| 602 bool CPDF_StreamParser::PositionIsInBounds() const { | 604 bool CPDF_StreamParser::PositionIsInBounds() const { |
| 603 return m_Pos < m_Size; | 605 return m_Pos < m_Size; |
| 604 } | 606 } |
| OLD | NEW |