Merge to XFA: Fix a heap overflow in CJBig2_Context::parseSymbolDict
authorJUN FANG <jun_fang@foxitsoftware.com>
Mon, 13 Apr 2015 17:34:10 +0000 (10:34 -0700)
committerJUN FANG <jun_fang@foxitsoftware.com>
Mon, 13 Apr 2015 17:44:51 +0000 (10:44 -0700)
BUG=476107
R=tsepez@chromium.org

Review URL: https://codereview.chromium.org/1080893002

core/src/fxcodec/jbig2/JBig2_ArithDecoder.h
core/src/fxcodec/jbig2/JBig2_ArithQe.h
core/src/fxcodec/jbig2/JBig2_GeneralDecoder.cpp

index 214688d..33bbe39 100644 (file)
@@ -72,6 +72,10 @@ inline void CJBig2_ArithDecoder::BYTEIN()
 }
 inline int CJBig2_ArithDecoder::DECODE(JBig2ArithCtx *pCX)
 {
+    if (!pCX || pCX->I >= JBIG2_QE_NUM) {
+        return 0;
+    }
+
     int D;
     const JBig2ArithQe * qe = &QeTable[pCX->I];
     A = A - qe->Qe;
index 5405e42..8a723be 100644 (file)
@@ -13,4 +13,5 @@ typedef struct {
     unsigned int nSwitch;
 } JBig2ArithQe;
 extern const JBig2ArithQe QeTable[];
+extern const unsigned int JBIG2_QE_NUM;
 #endif
index 6179317..53faab4 100644 (file)
@@ -61,6 +61,8 @@ extern const JBig2ArithQe QeTable[] = {
     { 0x5601, 46, 46, 0 }
 };
 
+extern const unsigned int JBIG2_QE_NUM = sizeof(QeTable) / sizeof(JBig2ArithQe);
+
 CJBig2_Image *CJBig2_GRDProc::decode_Arith(CJBig2_ArithDecoder *pArithDecoder, JBig2ArithCtx *gbContext)
 {
     if (GBW == 0 || GBH == 0) {