Index: kpdf/xpdf/xpdf/JBIG2Stream.cc
===================================================================
--- kpdf/xpdf/xpdf/JBIG2Stream.cc       (revision 466932)
+++ kpdf/xpdf/xpdf/JBIG2Stream.cc       (revision 488714)
@@ -7,6 +7,7 @@
//========================================================================

#include <aconf.h>
+#include <limits.h>

#ifdef USE_GCC_PRAGMAS
#pragma implementation
@@ -681,6 +682,13 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA,
  w = wA;
  h = hA;
  line = (wA + 7) >> 3;
+
+  if (h < 0 || line <= 0 || h >= INT_MAX / line) {
+    error(-1, "invalid width/height");
+    data = NULL;
+    return;
+  }
+
  data = (Guchar *)gmalloc(h * line);
}

@@ -690,6 +698,13 @@ JBIG2Bitmap::JBIG2Bitmap(Guint segNumA,
  w = bitmap->w;
  h = bitmap->h;
  line = bitmap->line;
+
+  if (h < 0 || line <= 0 || h >= INT_MAX / line) {
+    error(-1, "invalid width/height");
+    data = NULL;
+    return;
+  }
+
  data = (Guchar *)gmalloc(h * line);
  memcpy(data, bitmap->data, h * line);
}
@@ -716,7 +731,10 @@ JBIG2Bitmap *JBIG2Bitmap::getSlice(Guint
}

void JBIG2Bitmap::expand(int newH, Guint pixel) {
-  if (newH <= h) {
+  if (newH <= h || line <= 0 || newH >= INT_MAX / line) {
+    error(-1, "invalid width/height");
+    gfree(data);
+    data = NULL;
    return;
  }
  data = (Guchar *)grealloc(data, newH * line);
@@ -2256,6 +2274,15 @@ void JBIG2Stream::readHalftoneRegionSeg(
    error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");
    return;
  }
+  if (gridH == 0 || gridW >= INT_MAX / gridH) {
+    error(getPos(), "Bad size in JBIG2 halftone segment");
+    return;
+  }
+  if (w == 0 || h >= INT_MAX / w) {
+     error(getPos(), "Bad size in JBIG2 bitmap segment");
+    return;
+  }
+
  patternDict = (JBIG2PatternDict *)seg;
  bpp = 0;
  i = 1;
@@ -2887,6 +2914,11 @@ JBIG2Bitmap *JBIG2Stream::readGenericRef
  JBIG2BitmapPtr tpgrCXPtr0, tpgrCXPtr1, tpgrCXPtr2;
  int x, y, pix;

+  if (w < 0 || h <= 0 || w >= INT_MAX / h) {
+    error(-1, "invalid width/height");
+    return NULL;
+  }
+
  bitmap = new JBIG2Bitmap(0, w, h);
  bitmap->clearToZero();

Index: kpdf/xpdf/xpdf/Stream.cc
===================================================================
--- kpdf/xpdf/xpdf/Stream.cc    (revision 466932)
+++ kpdf/xpdf/xpdf/Stream.cc    (revision 488714)
@@ -15,6 +15,7 @@
#include <stdio.h>
#include <stdlib.h>
#include <stddef.h>
+#include <limits.h>
#ifndef WIN32
#include <unistd.h>
#endif
@@ -413,13 +414,27 @@ StreamPredictor::StreamPredictor(Stream
  width = widthA;
  nComps = nCompsA;
  nBits = nBitsA;
+  predLine = NULL;
+  ok = gFalse;
+
+  if (width <= 0 || nComps <= 0 || nBits <= 0 ||
+      nComps >= INT_MAX / nBits ||
+      width >= INT_MAX / nComps / nBits)
+    return;

  nVals = width * nComps;
+  if (nVals * nBits + 7 <= 0)
+    return;
  pixBytes = (nComps * nBits + 7) >> 3;
  rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;
+  if (rowBytes < 0)
+    return;
+
  predLine = (Guchar *)gmalloc(rowBytes);
  memset(predLine, 0, rowBytes);
  predIdx = rowBytes;
+
+  ok = gTrue;
}

StreamPredictor::~StreamPredictor() {
@@ -1013,6 +1028,10 @@ LZWStream::LZWStream(Stream *strA, int p
    FilterStream(strA) {
  if (predictor != 1) {
    pred = new StreamPredictor(this, predictor, columns, colors, bits);
+    if (!pred->isOk()) {
+      delete pred;
+      pred = NULL;
+    }
  } else {
    pred = NULL;
  }
@@ -1261,6 +1280,10 @@ CCITTFaxStream::CCITTFaxStream(Stream *s
  endOfLine = endOfLineA;
  byteAlign = byteAlignA;
  columns = columnsA;
+  if (columns < 1 || columns >= INT_MAX / sizeof(short)) {
+    error(-1, "invalid number of columns");
+    exit(1);
+  }
  rows = rowsA;
  endOfBlock = endOfBlockA;
  black = blackA;
@@ -2899,6 +2922,11 @@ GBool DCTStream::readBaselineSOF() {
  height = read16();
  width = read16();
  numComps = str->getChar();
+  if (numComps <= 0 || numComps > 4) {
+    numComps = 0;
+    error(getPos(), "Bad number of components in DCT stream");
+    return gFalse;
+  }
  if (prec != 8) {
    error(getPos(), "Bad DCT precision %d", prec);
    return gFalse;
@@ -2925,6 +2953,11 @@ GBool DCTStream::readProgressiveSOF() {
  height = read16();
  width = read16();
  numComps = str->getChar();
+  if (numComps <= 0 || numComps > 4) {
+    numComps = 0;
+    error(getPos(), "Bad number of components in DCT stream");
+    return gFalse;
+  }
  if (prec != 8) {
    error(getPos(), "Bad DCT precision %d", prec);
    return gFalse;
@@ -2947,6 +2980,11 @@ GBool DCTStream::readScanInfo() {

  length = read16() - 2;
  scanInfo.numComps = str->getChar();
+  if (scanInfo.numComps <= 0 || scanInfo.numComps > 4) {
+    scanInfo.numComps = 0;
+    error(getPos(), "Bad number of components in DCT stream");
+    return gFalse;
+  }
  --length;
  if (length != 2 * scanInfo.numComps + 3) {
    error(getPos(), "Bad DCT scan info block");
@@ -3021,12 +3059,12 @@ GBool DCTStream::readHuffmanTables() {
  while (length > 0) {
    index = str->getChar();
    --length;
-    if ((index & 0x0f) >= 4) {
+    if ((index & ~0x10) >= 4 || (index & ~0x10) < 0) {
      error(getPos(), "Bad DCT Huffman table");
      return gFalse;
    }
    if (index & 0x10) {
-      index &= 0x0f;
+      index &= 0x03;
      if (index >= numACHuffTables)
       numACHuffTables = index+1;
      tbl = &acHuffTables[index];
@@ -3144,9 +3182,11 @@ int DCTStream::readMarker() {
  do {
    do {
      c = str->getChar();
+      if(c == EOF) return EOF;
    } while (c != 0xff);
    do {
      c = str->getChar();
+      if(c == EOF) return EOF;
    } while (c == 0xff);
  } while (c == 0x00);
  return c;
@@ -3258,6 +3298,10 @@ FlateStream::FlateStream(Stream *strA, i
    FilterStream(strA) {
  if (predictor != 1) {
    pred = new StreamPredictor(this, predictor, columns, colors, bits);
+    if (!pred->isOk()) {
+      delete pred;
+      pred = NULL;
+    }
  } else {
    pred = NULL;
  }
Index: kpdf/xpdf/xpdf/Stream.h
===================================================================
--- kpdf/xpdf/xpdf/Stream.h     (revision 466932)
+++ kpdf/xpdf/xpdf/Stream.h     (revision 488714)
@@ -233,6 +233,8 @@ public:

  ~StreamPredictor();

+  GBool isOk() { return ok; }
+
  int lookChar();
  int getChar();

@@ -250,6 +252,7 @@ private:
  int rowBytes;                        // bytes per line
  Guchar *predLine;            // line buffer
  int predIdx;                 // current index in predLine
+  GBool ok;
};

//------------------------------------------------------------------------
Index: kpdf/xpdf/xpdf/JPXStream.cc
===================================================================
--- kpdf/xpdf/xpdf/JPXStream.cc (revision 466932)
+++ kpdf/xpdf/xpdf/JPXStream.cc (revision 488714)
@@ -7,6 +7,7 @@
//========================================================================

#include <aconf.h>
+#include <limits.h>

#ifdef USE_GCC_PRAGMAS
#pragma implementation
@@ -666,7 +667,7 @@ GBool JPXStream::readCodestream(Guint /*
  int segType;
  GBool haveSIZ, haveCOD, haveQCD, haveSOT;
  Guint precinctSize, style;
-  Guint segLen, capabilities, comp, i, j, r;
+  Guint segLen, capabilities, nTiles, comp, i, j, r;

  //----- main header
  haveSIZ = haveCOD = haveQCD = haveSOT = gFalse;
@@ -701,8 +702,12 @@ GBool JPXStream::readCodestream(Guint /*
                   / img.xTileSize;
      img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1)
                   / img.yTileSize;
-      img.tiles = (JPXTile *)gmalloc(img.nXTiles * img.nYTiles *
-                                    sizeof(JPXTile));
+      nTiles = img.nXTiles * img.nYTiles;
+      if (img.nXTiles <= 0 || img.nYTiles <= 0 || img.nXTiles >= INT_MAX / img.nYTiles) {
+        error(getPos(), "Bad tile count in JPX SIZ marker segment");
+        return gFalse;
+      }
+      img.tiles = (JPXTile *)gmallocn(nTiles, sizeof(JPXTile));
      for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {
       img.tiles[i].tileComps = (JPXTileComp *)gmalloc(img.nComps *
                                                       sizeof(JPXTileComp));
Index: kpdf/xpdf/goo/gmem.c
===================================================================
--- kpdf/xpdf/goo/gmem.c        (revision 466932)
+++ kpdf/xpdf/goo/gmem.c        (revision 488714)
@@ -11,6 +11,7 @@
#include <stdlib.h>
#include <stddef.h>
#include <string.h>
+#include <limits.h>
#include "gmem.h"

#ifdef DEBUG_MEM
@@ -175,6 +176,28 @@ void gfree(void *p) {
#endif
}

+void *gmallocn(int nObjs, int objSize) {
+  int n;
+
+  n = nObjs * objSize;
+  if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
+    fprintf(stderr, "Bogus memory allocation size\n");
+    exit(1);
+  }
+  return gmalloc(n);
+}
+
+void *greallocn(void *p, int nObjs, int objSize) {
+  int n;
+
+  n = nObjs * objSize;
+  if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
+    fprintf(stderr, "Bogus memory allocation size\n");
+    exit(1);
+  }
+  return grealloc(p, n);
+}
+
#ifdef DEBUG_MEM
void gMemReport(FILE *f) {
  GMemHdr *p;
Index: kpdf/xpdf/goo/gmem.h
===================================================================
--- kpdf/xpdf/goo/gmem.h        (revision 466932)
+++ kpdf/xpdf/goo/gmem.h        (revision 488714)
@@ -28,6 +28,15 @@ extern void *gmalloc(size_t size);
extern void *grealloc(void *p, size_t size);

/*
+ * These are similar to gmalloc and grealloc, but take an object count
+ * and size.  The result is similar to allocating nObjs * objSize
+ * bytes, but there is an additional error check that the total size
+ * doesn't overflow an int.
+ */
+extern void *gmallocn(int nObjs, int objSize);
+extern void *greallocn(void *p, int nObjs, int objSize);
+
+/*
 * Same as free, but checks for and ignores NULL pointers.
 */
extern void gfree(void *p);

You are viewing proxied material from ftp.icm.edu.pl. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.