diff options
Diffstat (limited to 'Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc')
-rw-r--r-- | Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc | 24 |
1 files changed, 17 insertions, 7 deletions
diff --git a/Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc b/Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc index 383ac5478ff..8387e55d0b0 100644 --- a/Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc +++ b/Build/source/libs/xpdf/xpdf-src/xpdf/Stream.cc @@ -8,10 +8,6 @@ #include <aconf.h> -#ifdef USE_GCC_PRAGMAS -#pragma implementation -#endif - #include <stdio.h> #include <stdlib.h> #include <stddef.h> @@ -2673,6 +2669,7 @@ DCTStream::DCTStream(Stream *strA, GBool colorXformA): frameBuf[i] = NULL; } rowBuf = NULL; + memset(quantTables, 0, sizeof(quantTables)); memset(dcHuffTables, 0, sizeof(dcHuffTables)); memset(acHuffTables, 0, sizeof(acHuffTables)); @@ -2894,7 +2891,7 @@ void DCTStream::prepare() { bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth; bufHeight = ((height + mcuHeight - 1) / mcuHeight) * mcuHeight; if (bufWidth <= 0 || bufHeight <= 0 || - bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) { + bufWidth > INT_MAX / bufHeight / (int)sizeof(int)) { error(errSyntaxError, getPos(), "Invalid image size in DCT stream"); y = height; prepared = gTrue; @@ -2942,7 +2939,13 @@ void DCTStream::prepare() { // allocate a buffer for one row of MCUs bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth; - rowBuf = (Guchar *)gmallocn(numComps * mcuHeight, bufWidth); + if (bufWidth <= 0 || bufWidth > INT_MAX / numComps / mcuHeight) { + error(errSyntaxError, getPos(), "Invalid image size in DCT stream"); + y = height; + prepared = gTrue; + return; + } + rowBuf = (Guchar *)gmallocn(bufWidth, numComps * mcuHeight); rowBufPtr = rowBufEnd = rowBuf; // initialize counters @@ -3848,11 +3851,12 @@ int DCTStream::readBit() { } GBool DCTStream::readHeader(GBool frame) { - GBool doScan; + GBool haveSOF, doScan; int n, i; int c = 0; // read headers + haveSOF = gFalse; doScan = gFalse; while (!doScan) { c = readMarker(); @@ -3867,6 +3871,7 @@ GBool DCTStream::readHeader(GBool frame) { if (!readBaselineSOF()) { return gFalse; } + haveSOF = gTrue; break; case 0xc2: // SOF2 (progressive) if (!frame) { @@ -3877,6 +3882,7 @@ GBool DCTStream::readHeader(GBool frame) { if (!readProgressiveSOF()) { return gFalse; } + haveSOF = gTrue; break; case 0xc4: // DHT if (!readHuffmanTables()) { @@ -3893,6 +3899,10 @@ GBool DCTStream::readHeader(GBool frame) { case 0xd9: // EOI return gFalse; case 0xda: // SOS + if (frame && !haveSOF) { + error(errSyntaxError, getPos(), "Missing SOF in DCT stream"); + return gFalse; + } if (!readScanInfo()) { return gFalse; } |