diff options
Diffstat (limited to 'Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc')
| -rw-r--r-- | Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc b/Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc index 537ee1a7901..e14821711b2 100644 --- a/Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc +++ b/Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc @@ -12,6 +12,7 @@ #include <stdlib.h> #include <string.h> +#include <limits.h> #include "gmem.h" #include "SplashErrorCodes.h" #include "SplashMath.h" @@ -1912,7 +1913,10 @@ SplashError Splash::fillImageMask(SplashImageMaskSource src, void *srcData, xq = w % scaledWidth; // allocate pixel buffer - pixBuf = (SplashColorPtr)gmalloc((yp + 1) * w); + if (yp < 0 || yp > INT_MAX - 1) { + return splashErrBadArg; + } + pixBuf = (SplashColorPtr)gmallocn(yp + 1, w); // initialize the pixel pipe pipeInit(&pipe, 0, 0, state->fillPattern, NULL, state->fillAlpha, @@ -2208,9 +2212,12 @@ SplashError Splash::drawImage(SplashImageSource src, void *srcData, xq = w % scaledWidth; // allocate pixel buffers - colorBuf = (SplashColorPtr)gmalloc((yp + 1) * w * nComps); + if (yp < 0 || yp > INT_MAX - 1 || w > INT_MAX / nComps) { + return splashErrBadArg; + } + colorBuf = (SplashColorPtr)gmallocn(yp + 1, w * nComps); if (srcAlpha) { - alphaBuf = (Guchar *)gmalloc((yp + 1) * w); + alphaBuf = (Guchar *)gmallocn(yp + 1, w); } else { alphaBuf = NULL; } |