diff options
Diffstat (limited to 'Build/source/libs/xpdf/xpdf-3.02')
-rw-r--r-- | Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc | 13 | ||||
-rw-r--r-- | Build/source/libs/xpdf/xpdf-3.02/splash/SplashBitmap.cc | 35 | ||||
-rw-r--r-- | Build/source/libs/xpdf/xpdf-3.02/splash/SplashErrorCodes.h | 2 | ||||
-rw-r--r-- | Build/source/libs/xpdf/xpdf-3.02/xpdf/PSOutputDev.cc | 2 | ||||
-rw-r--r-- | Build/source/libs/xpdf/xpdf-3.02/xpdf/Stream.cc | 4 | ||||
-rw-r--r-- | Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.cc | 21 | ||||
-rw-r--r-- | Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.h | 13 | ||||
-rw-r--r-- | Build/source/libs/xpdf/xpdf-3.02/xpdf/config.h | 2 |
8 files changed, 70 insertions, 22 deletions
diff --git a/Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc b/Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc index 537ee1a7901..e14821711b2 100644 --- a/Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc +++ b/Build/source/libs/xpdf/xpdf-3.02/splash/Splash.cc @@ -12,6 +12,7 @@ #include <stdlib.h> #include <string.h> +#include <limits.h> #include "gmem.h" #include "SplashErrorCodes.h" #include "SplashMath.h" @@ -1912,7 +1913,10 @@ SplashError Splash::fillImageMask(SplashImageMaskSource src, void *srcData, xq = w % scaledWidth; // allocate pixel buffer - pixBuf = (SplashColorPtr)gmalloc((yp + 1) * w); + if (yp < 0 || yp > INT_MAX - 1) { + return splashErrBadArg; + } + pixBuf = (SplashColorPtr)gmallocn(yp + 1, w); // initialize the pixel pipe pipeInit(&pipe, 0, 0, state->fillPattern, NULL, state->fillAlpha, @@ -2208,9 +2212,12 @@ SplashError Splash::drawImage(SplashImageSource src, void *srcData, xq = w % scaledWidth; // allocate pixel buffers - colorBuf = (SplashColorPtr)gmalloc((yp + 1) * w * nComps); + if (yp < 0 || yp > INT_MAX - 1 || w > INT_MAX / nComps) { + return splashErrBadArg; + } + colorBuf = (SplashColorPtr)gmallocn(yp + 1, w * nComps); if (srcAlpha) { - alphaBuf = (Guchar *)gmalloc((yp + 1) * w); + alphaBuf = (Guchar *)gmallocn(yp + 1, w); } else { alphaBuf = NULL; } diff --git a/Build/source/libs/xpdf/xpdf-3.02/splash/SplashBitmap.cc b/Build/source/libs/xpdf/xpdf-3.02/splash/SplashBitmap.cc index 0cb1a752af5..62bbd8e8afb 100644 --- a/Build/source/libs/xpdf/xpdf-3.02/splash/SplashBitmap.cc +++ b/Build/source/libs/xpdf/xpdf-3.02/splash/SplashBitmap.cc @@ -11,6 +11,7 @@ #endif #include <stdio.h> +#include <limits.h> #include "gmem.h" #include "SplashErrorCodes.h" #include "SplashBitmap.h" @@ -27,30 +28,48 @@ SplashBitmap::SplashBitmap(int widthA, int heightA, int rowPad, mode = modeA; switch (mode) { case splashModeMono1: - rowSize = (width + 7) >> 3; + if (width > 0) { + rowSize = (width + 7) >> 3; + } else { + rowSize = -1; + } break; case splashModeMono8: - rowSize = width; + if (width > 0) { + rowSize = width; + } else { + rowSize = -1; + } break; case splashModeRGB8: case splashModeBGR8: - rowSize = width * 3; + if (width > 0 && width <= INT_MAX / 3) { + rowSize = width * 3; + } else { + rowSize = -1; + } break; #if SPLASH_CMYK case splashModeCMYK8: - rowSize = width * 4; + if (width > 0 && width <= INT_MAX / 4) { + rowSize = width * 4; + } else { + rowSize = -1; + } break; #endif } - rowSize += rowPad - 1; - rowSize -= rowSize % rowPad; - data = (SplashColorPtr)gmalloc(rowSize * height); + if (rowSize > 0) { + rowSize += rowPad - 1; + rowSize -= rowSize % rowPad; + } + data = (SplashColorPtr)gmallocn(height, rowSize); if (!topDown) { data += (height - 1) * rowSize; rowSize = -rowSize; } if (alphaA) { - alpha = (Guchar *)gmalloc(width * height); + alpha = (Guchar *)gmallocn(width, height); } else { alpha = NULL; } diff --git a/Build/source/libs/xpdf/xpdf-3.02/splash/SplashErrorCodes.h b/Build/source/libs/xpdf/xpdf-3.02/splash/SplashErrorCodes.h index 2a70d4b77d6..7bdaf14e43a 100644 --- a/Build/source/libs/xpdf/xpdf-3.02/splash/SplashErrorCodes.h +++ b/Build/source/libs/xpdf/xpdf-3.02/splash/SplashErrorCodes.h @@ -29,4 +29,6 @@ #define splashErrSingularMatrix 8 // matrix is singular +#define splashErrBadArg 9 // bad argument + #endif diff --git a/Build/source/libs/xpdf/xpdf-3.02/xpdf/PSOutputDev.cc b/Build/source/libs/xpdf/xpdf-3.02/xpdf/PSOutputDev.cc index 8a1a9e9a317..d5970aeb07b 100644 --- a/Build/source/libs/xpdf/xpdf-3.02/xpdf/PSOutputDev.cc +++ b/Build/source/libs/xpdf/xpdf-3.02/xpdf/PSOutputDev.cc @@ -4301,7 +4301,7 @@ void PSOutputDev::doImageL1Sep(GfxImageColorMap *colorMap, width, -height, height); // allocate a line buffer - lineBuf = (Guchar *)gmalloc(4 * width); + lineBuf = (Guchar *)gmallocn(width, 4); // set up to process the data stream imgStr = new ImageStream(str, width, colorMap->getNumPixelComps(), diff --git a/Build/source/libs/xpdf/xpdf-3.02/xpdf/Stream.cc b/Build/source/libs/xpdf/xpdf-3.02/xpdf/Stream.cc index 812d00c39a3..368eddbaf24 100644 --- a/Build/source/libs/xpdf/xpdf-3.02/xpdf/Stream.cc +++ b/Build/source/libs/xpdf/xpdf-3.02/xpdf/Stream.cc @@ -323,6 +323,10 @@ ImageStream::ImageStream(Stream *strA, int widthA, int nCompsA, int nBitsA) { } else { imgLineSize = nVals; } + if (width > INT_MAX / nComps) { + // force a call to gmallocn(-1,...), which will throw an exception + imgLineSize = -1; + } imgLine = (Guchar *)gmallocn(imgLineSize, sizeof(Guchar)); imgIdx = nVals; } diff --git a/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.cc b/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.cc index 6fbf8b5d032..4c78a9dc165 100644 --- a/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.cc +++ b/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.cc @@ -59,6 +59,7 @@ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) { objs = NULL; objNums = NULL; offsets = NULL; + ok = gFalse; if (!xref->fetch(objStrNum, 0, &objStr)->isStream()) { goto err1; @@ -85,6 +86,13 @@ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) { goto err1; } + // this is an arbitrary limit to avoid integer overflow problems + // in the 'new Object[nObjects]' call (Acrobat apparently limits + // object streams to 100-200 objects) + if (nObjects > 1000000) { + error(-1, "Too many objects in an object stream"); + goto err1; + } objs = new Object[nObjects]; objNums = (int *)gmallocn(nObjects, sizeof(int)); offsets = (int *)gmallocn(nObjects, sizeof(int)); @@ -101,7 +109,7 @@ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) { obj1.free(); obj2.free(); delete parser; -// gfree(offsets); +// gfree(offsets); goto err1; } objNums[i] = obj1.getInt(); @@ -111,7 +119,7 @@ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) { if (objNums[i] < 0 || offsets[i] < 0 || (i > 0 && offsets[i] < offsets[i-1])) { delete parser; -// gfree(offsets); +// gfree(offsets); goto err1; } } @@ -140,11 +148,11 @@ ObjectStream::ObjectStream(XRef *xref, int objStrNumA) { delete parser; } -// gfree(offsets); +//gfree(offsets); + ok = gTrue; err1: objStr.free(); - return; } ObjectStream::~ObjectStream() { @@ -818,6 +826,11 @@ Object *XRef::fetch(int num, int gen, Object *obj) { delete objStr; } objStr = new ObjectStream(this, e->offset); + if (!objStr->isOk()) { + delete objStr; + objStr = NULL; + goto err; + } } objStr->getObject(e->gen, num, obj); break; diff --git a/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.h b/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.h index f244264b3de..dd71211466f 100644 --- a/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.h +++ b/Build/source/libs/xpdf/xpdf-3.02/xpdf/XRef.h @@ -32,6 +32,8 @@ public: // generation 0. ObjectStream(XRef *xref, int objStrNumA); + GBool isOk() { return ok; } + ~ObjectStream(); // Return the object number of this object stream. @@ -46,12 +48,13 @@ public: private: - int objStrNum; // object number of the object stream - int nObjects; // number of objects in the stream - Object *objs; // the objects (length = nObjects) - int *objNums; // the object numbers (length = nObjects) - int *offsets; // the object offsets (length = nObjects) + int objStrNum; // object number of the object stream + int nObjects; // number of objects in the stream + Object *objs; // the objects (length = nObjects) + int *objNums; // the object numbers (length = nObjects) + int *offsets; // the object offsets (length = nObjects) Guint firstOffset; + GBool ok; }; diff --git a/Build/source/libs/xpdf/xpdf-3.02/xpdf/config.h b/Build/source/libs/xpdf/xpdf-3.02/xpdf/config.h index 49e72ad0eb3..ce3efc50784 100644 --- a/Build/source/libs/xpdf/xpdf-3.02/xpdf/config.h +++ b/Build/source/libs/xpdf/xpdf-3.02/xpdf/config.h @@ -17,7 +17,7 @@ //------------------------------------------------------------------------ // xpdf version -#define xpdfVersion "3.02pl3" +#define xpdfVersion "3.02pl4" #define xpdfVersionNum 3.02 #define xpdfMajorVersion 3 #define xpdfMinorVersion 2 |