diff options
author | Akira Kakuto <kakuto@fuk.kindai.ac.jp> | 2019-02-25 03:01:12 +0000 |
---|---|---|
committer | Akira Kakuto <kakuto@fuk.kindai.ac.jp> | 2019-02-25 03:01:12 +0000 |
commit | 3112e1aed533fe7ee58dd8cba2e4cd768372dfd6 (patch) | |
tree | 02077f80cf4a13a6c571bace448a53a38a9b6768 /Build/source/libs/xpdf/xpdf-src/splash/SplashBitmap.cc | |
parent | 73052dd2c8e70e61b653151192fe1f000fcf626d (diff) |
xpdf-4.01
git-svn-id: svn://tug.org/texlive/trunk@50122 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/libs/xpdf/xpdf-src/splash/SplashBitmap.cc')
-rw-r--r-- | Build/source/libs/xpdf/xpdf-src/splash/SplashBitmap.cc | 46 |
1 files changed, 23 insertions, 23 deletions
diff --git a/Build/source/libs/xpdf/xpdf-src/splash/SplashBitmap.cc b/Build/source/libs/xpdf/xpdf-src/splash/SplashBitmap.cc index 32ecc3fdd03..aa916179df3 100644 --- a/Build/source/libs/xpdf/xpdf-src/splash/SplashBitmap.cc +++ b/Build/source/libs/xpdf/xpdf-src/splash/SplashBitmap.cc @@ -26,54 +26,53 @@ SplashBitmap::SplashBitmap(int widthA, int heightA, int rowPad, SplashColorMode modeA, GBool alphaA, GBool topDown) { + // NB: this code checks that rowSize fits in a signed 32-bit + // integer, because some code (outside this class) makes that + // assumption width = widthA; height = heightA; mode = modeA; switch (mode) { case splashModeMono1: - if (width > 0) { - rowSize = (width + 7) >> 3; - } else { - rowSize = -1; + if (width <= 0) { + gMemError("invalid bitmap width"); } + rowSize = (width + 7) >> 3; break; case splashModeMono8: - if (width > 0) { - rowSize = width; - } else { - rowSize = -1; + if (width <= 0) { + gMemError("invalid bitmap width"); } + rowSize = width; break; case splashModeRGB8: case splashModeBGR8: - if (width > 0 && width <= INT_MAX / 3) { - rowSize = width * 3; - } else { - rowSize = -1; + if (width <= 0 || width > INT_MAX / 3) { + gMemError("invalid bitmap width"); } + rowSize = (SplashBitmapRowSize)width * 3; break; #if SPLASH_CMYK case splashModeCMYK8: - if (width > 0 && width <= INT_MAX / 4) { - rowSize = width * 4; - } else { - rowSize = -1; + if (width <= 0 || width > INT_MAX / 4) { + gMemError("invalid bitmap width"); } + rowSize = (SplashBitmapRowSize)width * 4; break; #endif } - if (rowSize > 0) { - rowSize += rowPad - 1; - rowSize -= rowSize % rowPad; - } - data = (SplashColorPtr)gmallocn(height, rowSize); + rowSize += rowPad - 1; + rowSize -= rowSize % rowPad; + data = (SplashColorPtr)gmallocn64(height, rowSize); if (!topDown) { data += (height - 1) * rowSize; rowSize = -rowSize; } if (alphaA) { - alpha = (Guchar *)gmallocn(width, height); + alphaRowSize = width; + alpha = (Guchar *)gmallocn64(height, alphaRowSize); } else { + alphaRowSize = 0; alpha = NULL; } } @@ -231,7 +230,7 @@ void SplashBitmap::getPixel(int x, int y, SplashColorPtr pixel) { } Guchar SplashBitmap::getAlpha(int x, int y) { - return alpha[y * width + x]; + return alpha[y * (size_t)width + x]; } SplashColorPtr SplashBitmap::takeData() { @@ -241,3 +240,4 @@ SplashColorPtr SplashBitmap::takeData() { data = NULL; return data2; } + |