Index: kpdf/goo/gmem.c
===================================================================
--- kpdf/goo/gmem.c     (revision 409205)
+++ kpdf/goo/gmem.c     (revision 488727)
@@ -11,6 +11,7 @@
#include <stdlib.h>
#include <stddef.h>
#include <string.h>
+#include <limits.h>
#include "gmem.h"

#ifdef DEBUG_MEM
@@ -135,6 +136,28 @@ void *grealloc(void *p, int size) {
#endif
}

+void *gmallocn(int nObjs, int objSize) {
+  int n;
+
+  n = nObjs * objSize;
+  if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
+    fprintf(stderr, "Bogus memory allocation size\n");
+    exit(1);
+  }
+  return gmalloc(n);
+}
+
+void *greallocn(void *p, int nObjs, int objSize) {
+  int n;
+
+  n = nObjs * objSize;
+  if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
+    fprintf(stderr, "Bogus memory allocation size\n");
+    exit(1);
+  }
+  return grealloc(p, n);
+}
+
void gfree(void *p) {
#ifdef DEBUG_MEM
  int size;
Index: kpdf/goo/gmem.h
===================================================================
--- kpdf/goo/gmem.h     (revision 409205)
+++ kpdf/goo/gmem.h     (revision 488727)
@@ -28,6 +28,15 @@ extern void *gmalloc(int size);
extern void *grealloc(void *p, int size);

/*
+ * These are similar to gmalloc and grealloc, but take an object count
+ * and size.  The result is similar to allocating nObjs * objSize
+ * bytes, but there is an additional error check that the total size
+ * doesn't overflow an int.
+ */
+extern void *gmallocn(int nObjs, int objSize);
+extern void *greallocn(void *p, int nObjs, int objSize);
+
+/*
 * Same as free, but checks for and ignores NULL pointers.
 */
extern void gfree(void *p);
Index: kpdf/xpdf/JBIG2Stream.cc
===================================================================
--- kpdf/xpdf/JBIG2Stream.cc    (revision 409205)
+++ kpdf/xpdf/JBIG2Stream.cc    (revision 488727)
@@ -7,6 +7,7 @@
//========================================================================

#include <aconf.h>
+#include <limits.h>

#ifdef USE_GCC_PRAGMAS
#pragma implementation
@@ -681,6 +682,13 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA,
  w = wA;
  h = hA;
  line = (wA + 7) >> 3;
+
+  if (h < 0 || line <= 0 || h >= INT_MAX / line) {
+    error(-1, "invalid width/height");
+    data = NULL;
+    return;
+  }
+
  data = (Guchar *)gmalloc(h * line);
}

@@ -690,6 +698,13 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA,
  w = bitmap->w;
  h = bitmap->h;
  line = bitmap->line;
+
+  if (h < 0 || line <= 0 || h >= INT_MAX / line) {
+    error(-1, "invalid width/height");
+    data = NULL;
+    return;
+  }
+
  data = (Guchar *)gmalloc(h * line);
  memcpy(data, bitmap->data, h * line);
}
@@ -716,7 +731,10 @@ JBIG2Bitmap *JBIG2Bitmap::getSlice(Guint
}

void JBIG2Bitmap::expand(int newH, Guint pixel) {
-  if (newH <= h) {
+  if (newH <= h || line <= 0 || newH >= INT_MAX / line) {
+    error(-1, "invalid width/height");
+    gfree(data);
+    data = NULL;
    return;
  }
  data = (Guchar *)grealloc(data, newH * line);
@@ -2256,6 +2274,15 @@ void JBIG2Stream::readHalftoneRegionSeg(
    error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");
    return;
  }
+  if (gridH == 0 || gridW >= INT_MAX / gridH) {
+    error(getPos(), "Bad size in JBIG2 halftone segment");
+    return;
+  }
+  if (w == 0 || h >= INT_MAX / w) {
+     error(getPos(), "Bad size in JBIG2 bitmap segment");
+    return;
+  }
+
  patternDict = (JBIG2PatternDict *)seg;
  bpp = 0;
  i = 1;
@@ -2887,6 +2914,11 @@ JBIG2Bitmap *JBIG2Stream::readGenericRef
  JBIG2BitmapPtr tpgrCXPtr0, tpgrCXPtr1, tpgrCXPtr2;
  int x, y, pix;

+  if (w < 0 || h <= 0 || w >= INT_MAX / h) {
+    error(-1, "invalid width/height");
+    return NULL;
+  }
+
  bitmap = new JBIG2Bitmap(0, w, h);
  bitmap->clearToZero();

Index: kpdf/xpdf/Stream.cc
===================================================================
--- kpdf/xpdf/Stream.cc (revision 409205)
+++ kpdf/xpdf/Stream.cc (revision 488727)
@@ -15,6 +15,7 @@
#include <stdio.h>
#include <stdlib.h>
#include <stddef.h>
+#include <limits.h>
#ifndef WIN32
#include <unistd.h>
#endif
@@ -412,13 +413,27 @@ StreamPredictor::StreamPredictor(Stream
  width = widthA;
  nComps = nCompsA;
  nBits = nBitsA;
+  predLine = NULL;
+  ok = gFalse;
+
+  if (width <= 0 || nComps <= 0 || nBits <= 0 ||
+      nComps >= INT_MAX / nBits ||
+      width >= INT_MAX / nComps / nBits)
+    return;

  nVals = width * nComps;
+  if (nVals * nBits + 7 <= 0)
+    return;
  pixBytes = (nComps * nBits + 7) >> 3;
  rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
+  if (rowBytes < 0)
+    return;
+
  predLine = (Guchar *)gmalloc(rowBytes);
  memset(predLine, 0, rowBytes);
  predIdx = rowBytes;
+
+  ok = gTrue;
}

StreamPredictor::~StreamPredictor() {
@@ -1012,6 +1027,10 @@ LZWStream::LZWStream(Stream *strA, int p
    FilterStream(strA) {
  if (predictor != 1) {
    pred = new StreamPredictor(this, predictor, columns, colors, bits);
+    if (!pred->isOk()) {
+      delete pred;
+      pred = NULL;
+    }
  } else {
    pred = NULL;
  }
@@ -1260,6 +1279,10 @@ CCITTFaxStream::CCITTFaxStream(Stream *s
  endOfLine = endOfLineA;
  byteAlign = byteAlignA;
  columns = columnsA;
+  if (columns < 1 || columns >= INT_MAX / sizeof(short)) {
+    error(-1, "invalid number of columns");
+    exit(1);
+  }
  rows = rowsA;
  endOfBlock = endOfBlockA;
  black = blackA;
@@ -2897,6 +2920,10 @@ GBool DCTStream::readBaselineSOF() {
  height = read16();
  width = read16();
  numComps = str->getChar();
+  if (numComps <= 0 || numComps > 4) {
+    error(getPos(), "Bad number of components in DCT stream", prec);
+    return gFalse;
+  }
  if (prec != 8) {
    error(getPos(), "Bad DCT precision %d", prec);
    return gFalse;
@@ -2923,6 +2950,12 @@ GBool DCTStream::readProgressiveSOF() {
  height = read16();
  width = read16();
  numComps = str->getChar();
+  if (numComps <= 0 || numComps > 4) {
+     numComps = 0;
+     numComps = 0;
+     error(getPos(), "Bad number of components in DCT stream");
+     return gFalse;
+  }
  if (prec != 8) {
    error(getPos(), "Bad DCT precision %d", prec);
    return gFalse;
@@ -2945,6 +2978,11 @@ GBool DCTStream::readScanInfo() {

  length = read16() - 2;
  scanInfo.numComps = str->getChar();
+  if (scanInfo.numComps <= 0 || scanInfo.numComps > 4) {
+     scanInfo.numComps = 0;
+     error(getPos(), "Bad number of components in DCT stream");
+     return gFalse;
+  }
  --length;
  if (length != 2 * scanInfo.numComps + 3) {
    error(getPos(), "Bad DCT scan info block");
@@ -3019,12 +3057,12 @@ GBool DCTStream::readHuffmanTables() {
  while (length > 0) {
    index = str->getChar();
    --length;
-    if ((index & 0x0f) >= 4) {
+    if ((index & ~0x10) >= 4 || (index & ~0x10) < 0) {
      error(getPos(), "Bad DCT Huffman table");
      return gFalse;
    }
    if (index & 0x10) {
-      index &= 0x0f;
+      index &= 0x03;
      if (index >= numACHuffTables)
       numACHuffTables = index+1;
      tbl = &acHuffTables[index];
@@ -3142,9 +3180,11 @@ int DCTStream::readMarker() {
  do {
    do {
      c = str->getChar();
+      if(c == EOF) return EOF;
    } while (c != 0xff);
    do {
      c = str->getChar();
+      if(c == EOF) return EOF;
    } while (c == 0xff);
  } while (c == 0x00);
  return c;
@@ -3255,6 +3295,10 @@ FlateStream::FlateStream(Stream *strA, i
    FilterStream(strA) {
  if (predictor != 1) {
    pred = new StreamPredictor(this, predictor, columns, colors, bits);
+    if (!pred->isOk()) {
+      delete pred;
+      pred = NULL;
+    }
  } else {
    pred = NULL;
  }
Index: kpdf/xpdf/Stream.h
===================================================================
--- kpdf/xpdf/Stream.h  (revision 409205)
+++ kpdf/xpdf/Stream.h  (revision 488727)
@@ -233,6 +233,8 @@ public:

  ~StreamPredictor();

+  GBool isOk() { return ok; }
+
  int lookChar();
  int getChar();

@@ -250,6 +252,7 @@ private:
  int rowBytes;                        // bytes per line
  Guchar *predLine;            // line buffer
  int predIdx;                 // current index in predLine
+  GBool ok;
};

//------------------------------------------------------------------------
Index: kpdf/xpdf/TextOutputDev.h
===================================================================
--- kpdf/xpdf/TextOutputDev.h   (revision 409205)
+++ kpdf/xpdf/TextOutputDev.h   (revision 488727)
@@ -25,6 +25,14 @@ class GList;
class GfxFont;
class GfxState;
class UnicodeMap;
+class TextWord;
+class TextPool;
+class TextLine;
+class TextLineFrag;
+class TextBlock;
+class TextFlow;
+class TextWordList;
+class TextPage;

//------------------------------------------------------------------------

Index: kpdf/xpdf/JPXStream.cc
===================================================================
--- kpdf/xpdf/JPXStream.cc      (revision 409205)
+++ kpdf/xpdf/JPXStream.cc      (revision 488727)
@@ -7,6 +7,7 @@
//========================================================================

#include <aconf.h>
+#include <limits.h>

#ifdef USE_GCC_PRAGMAS
#pragma implementation
@@ -666,7 +667,7 @@ GBool JPXStream::readCodestream(Guint /*
  int segType;
  GBool haveSIZ, haveCOD, haveQCD, haveSOT;
  Guint precinctSize, style;
-  Guint segLen, capabilities, comp, i, j, r;
+  Guint segLen, capabilities, nTiles, comp, i, j, r;

  //----- main header
  haveSIZ = haveCOD = haveQCD = haveSOT = gFalse;
@@ -701,8 +702,13 @@ GBool JPXStream::readCodestream(Guint /*
                   / img.xTileSize;
      img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1)
                   / img.yTileSize;
-      img.tiles = (JPXTile *)gmalloc(img.nXTiles * img.nYTiles *
-                                    sizeof(JPXTile));
+      nTiles = img.nXTiles * img.nYTiles;
+      // check for overflow before allocating memory
+      if (img.nXTiles <= 0 || img.nYTiles <= 0 || img.nXTiles >= INT_MAX / img.nYTiles) {
+       error(getPos(), "Bad tile count in JPX SIZ marker segment");
+       return gFalse;
+      }
+      img.tiles = (JPXTile *)gmalloc(nTiles * sizeof(JPXTile));
      for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {
       img.tiles[i].tileComps = (JPXTileComp *)gmalloc(img.nComps *
                                                       sizeof(JPXTileComp));

You are viewing proxied material from ftp.icm.edu.pl. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.