summaryrefslogtreecommitdiff
path: root/Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc')
-rw-r--r--Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc24
1 files changed, 17 insertions, 7 deletions
diff --git a/Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc b/Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc
index 383ac5478ff..8387e55d0b0 100644
--- a/Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc
+++ b/Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc
@@ -8,10 +8,6 @@
#include <aconf.h>
-#ifdef USE_GCC_PRAGMAS
-#pragma implementation
-#endif
-
#include <stdio.h>
#include <stdlib.h>
#include <stddef.h>
@@ -2673,6 +2669,7 @@ DCTStream::DCTStream(Stream *strA, GBool colorXformA):
frameBuf[i] = NULL;
}
rowBuf = NULL;
+ memset(quantTables, 0, sizeof(quantTables));
memset(dcHuffTables, 0, sizeof(dcHuffTables));
memset(acHuffTables, 0, sizeof(acHuffTables));
@@ -2894,7 +2891,7 @@ void DCTStream::prepare() {
bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth;
bufHeight = ((height + mcuHeight - 1) / mcuHeight) * mcuHeight;
if (bufWidth <= 0 || bufHeight <= 0 ||
- bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) {
+ bufWidth > INT_MAX / bufHeight / (int)sizeof(int)) {
error(errSyntaxError, getPos(), "Invalid image size in DCT stream");
y = height;
prepared = gTrue;
@@ -2942,7 +2939,13 @@ void DCTStream::prepare() {
// allocate a buffer for one row of MCUs
bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth;
- rowBuf = (Guchar *)gmallocn(numComps * mcuHeight, bufWidth);
+ if (bufWidth <= 0 || bufWidth > INT_MAX / numComps / mcuHeight) {
+ error(errSyntaxError, getPos(), "Invalid image size in DCT stream");
+ y = height;
+ prepared = gTrue;
+ return;
+ }
+ rowBuf = (Guchar *)gmallocn(bufWidth, numComps * mcuHeight);
rowBufPtr = rowBufEnd = rowBuf;
// initialize counters
@@ -3848,11 +3851,12 @@ int DCTStream::readBit() {
}
GBool DCTStream::readHeader(GBool frame) {
- GBool doScan;
+ GBool haveSOF, doScan;
int n, i;
int c = 0;
// read headers
+ haveSOF = gFalse;
doScan = gFalse;
while (!doScan) {
c = readMarker();
@@ -3867,6 +3871,7 @@ GBool DCTStream::readHeader(GBool frame) {
if (!readBaselineSOF()) {
return gFalse;
}
+ haveSOF = gTrue;
break;
case 0xc2: // SOF2 (progressive)
if (!frame) {
@@ -3877,6 +3882,7 @@ GBool DCTStream::readHeader(GBool frame) {
if (!readProgressiveSOF()) {
return gFalse;
}
+ haveSOF = gTrue;
break;
case 0xc4: // DHT
if (!readHuffmanTables()) {
@@ -3893,6 +3899,10 @@ GBool DCTStream::readHeader(GBool frame) {
case 0xd9: // EOI
return gFalse;
case 0xda: // SOS
+ if (frame && !haveSOF) {
+ error(errSyntaxError, getPos(), "Missing SOF in DCT stream");
+ return gFalse;
+ }
if (!readScanInfo()) {
return gFalse;
}