summaryrefslogtreecommitdiff
path: root/Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc')
-rw-r--r--Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc13
1 files changed, 10 insertions, 3 deletions
diff --git a/Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc b/Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc
index 537ee1a7901..e14821711b2 100644
--- a/Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc
+++ b/Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc
@@ -12,6 +12,7 @@
#include <stdlib.h>
#include <string.h>
+#include <limits.h>
#include "gmem.h"
#include "SplashErrorCodes.h"
#include "SplashMath.h"
@@ -1912,7 +1913,10 @@ SplashError Splash::fillImageMask(SplashImageMaskSource src, void *srcData,
xq = w % scaledWidth;
// allocate pixel buffer
- pixBuf = (SplashColorPtr)gmalloc((yp + 1) * w);
+ if (yp < 0 || yp > INT_MAX - 1) {
+ return splashErrBadArg;
+ }
+ pixBuf = (SplashColorPtr)gmallocn(yp + 1, w);
// initialize the pixel pipe
pipeInit(&pipe, 0, 0, state->fillPattern, NULL, state->fillAlpha,
@@ -2208,9 +2212,12 @@ SplashError Splash::drawImage(SplashImageSource src, void *srcData,
xq = w % scaledWidth;
// allocate pixel buffers
- colorBuf = (SplashColorPtr)gmalloc((yp + 1) * w * nComps);
+ if (yp < 0 || yp > INT_MAX - 1 || w > INT_MAX / nComps) {
+ return splashErrBadArg;
+ }
+ colorBuf = (SplashColorPtr)gmallocn(yp + 1, w * nComps);
if (srcAlpha) {
- alphaBuf = (Guchar *)gmalloc((yp + 1) * w);
+ alphaBuf = (Guchar *)gmallocn(yp + 1, w);
} else {
alphaBuf = NULL;
}