diff options
author | Akira Kakuto <kakuto@fuk.kindai.ac.jp> | 2024-02-10 06:55:23 +0000 |
---|---|---|
committer | Akira Kakuto <kakuto@fuk.kindai.ac.jp> | 2024-02-10 06:55:23 +0000 |
commit | 0357cc55904fda095727bb30f07b68dbf3439f8e (patch) | |
tree | 4dfe670d69c9d538606e6d49fe29b506c05e5975 /Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc | |
parent | 28c5129fe7864e1005edc90cf737372ba1bc78c7 (diff) |
xpdf 4.05
git-svn-id: svn://tug.org/texlive/trunk@69765 c570f23f-e606-0410-a88d-b1316a301751
Diffstat (limited to 'Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc')
-rw-r--r-- | Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc | 24 |
1 files changed, 17 insertions, 7 deletions
diff --git a/Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc b/Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc index 383ac5478ff..8387e55d0b0 100644 --- a/Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc +++ b/Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc @@ -8,10 +8,6 @@ #include <aconf.h> -#ifdef USE_GCC_PRAGMAS -#pragma implementation -#endif - #include <stdio.h> #include <stdlib.h> #include <stddef.h> @@ -2673,6 +2669,7 @@ DCTStream::DCTStream(Stream *strA, GBool colorXformA): frameBuf[i] = NULL; } rowBuf = NULL; + memset(quantTables, 0, sizeof(quantTables)); memset(dcHuffTables, 0, sizeof(dcHuffTables)); memset(acHuffTables, 0, sizeof(acHuffTables)); @@ -2894,7 +2891,7 @@ void DCTStream::prepare() { bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth; bufHeight = ((height + mcuHeight - 1) / mcuHeight) * mcuHeight; if (bufWidth <= 0 || bufHeight <= 0 || - bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) { + bufWidth > INT_MAX / bufHeight / (int)sizeof(int)) { error(errSyntaxError, getPos(), "Invalid image size in DCT stream"); y = height; prepared = gTrue; @@ -2942,7 +2939,13 @@ void DCTStream::prepare() { // allocate a buffer for one row of MCUs bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth; - rowBuf = (Guchar *)gmallocn(numComps * mcuHeight, bufWidth); + if (bufWidth <= 0 || bufWidth > INT_MAX / numComps / mcuHeight) { + error(errSyntaxError, getPos(), "Invalid image size in DCT stream"); + y = height; + prepared = gTrue; + return; + } + rowBuf = (Guchar *)gmallocn(bufWidth, numComps * mcuHeight); rowBufPtr = rowBufEnd = rowBuf; // initialize counters @@ -3848,11 +3851,12 @@ int DCTStream::readBit() { } GBool DCTStream::readHeader(GBool frame) { - GBool doScan; + GBool haveSOF, doScan; int n, i; int c = 0; // read headers + haveSOF = gFalse; doScan = gFalse; while (!doScan) { c = readMarker(); @@ -3867,6 +3871,7 @@ GBool DCTStream::readHeader(GBool frame) { if (!readBaselineSOF()) { return gFalse; } + haveSOF = gTrue; break; case 0xc2: // SOF2 (progressive) if (!frame) { @@ -3877,6 +3882,7 @@ GBool DCTStream::readHeader(GBool frame) { if (!readProgressiveSOF()) { return gFalse; } + haveSOF = gTrue; break; case 0xc4: // DHT if (!readHuffmanTables()) { @@ -3893,6 +3899,10 @@ GBool DCTStream::readHeader(GBool frame) { case 0xd9: // EOI return gFalse; case 0xda: // SOS + if (frame && !haveSOF) { + error(errSyntaxError, getPos(), "Missing SOF in DCT stream"); + return gFalse; + } if (!readScanInfo()) { return gFalse; } |