diff options
| author | Sebastian Rasmussen <sebras@gmail.com> | 2018-04-08 20:34:43 +0800 |
|---|---|---|
| committer | Sebastian Rasmussen <sebras@gmail.com> | 2018-04-11 11:45:12 +0800 |
| commit | 890e637bf7a1d8a5e3438c2aab4e0eef33d795f1 (patch) | |
| tree | 90aff7be8d90a8997f935f46601dfdfdf13a18bb /jbig2dec/jbig2_text.c | |
| parent | 44ff6900ac97d53101c8585880acb9a73631cefe (diff) | |
| download | ghostpdl-890e637bf7a1d8a5e3438c2aab4e0eef33d795f1.tar.gz | |
jbig2dec: Detect data shortage.
Diffstat (limited to 'jbig2dec/jbig2_text.c')
| -rw-r--r-- | jbig2dec/jbig2_text.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/jbig2dec/jbig2_text.c b/jbig2dec/jbig2_text.c index 69e1ceab3..f66b2cc7a 100644 --- a/jbig2dec/jbig2_text.c +++ b/jbig2dec/jbig2_text.c @@ -519,6 +519,8 @@ jbig2_text_region(Jbig2Ctx *ctx, Jbig2Segment *segment, const byte *segment_data offset += 17; /* 7.4.3.1.1 */ + if (segment->data_length - offset < 2) + goto too_short; flags = jbig2_get_uint16(segment_data + offset); offset += 2; @@ -547,6 +549,8 @@ jbig2_text_region(Jbig2Ctx *ctx, Jbig2Segment *segment, const byte *segment_data if (params.SBHUFF) { /* Huffman coding */ /* 7.4.3.1.2 */ + if (segment->data_length - offset < 2) + goto too_short; huffman_flags = jbig2_get_uint16(segment_data + offset); offset += 2; @@ -555,6 +559,8 @@ jbig2_text_region(Jbig2Ctx *ctx, Jbig2Segment *segment, const byte *segment_data } else { /* arithmetic coding */ /* 7.4.3.1.3 */ + if (segment->data_length - offset < 4) + goto too_short; if ((params.SBREFINE) && !(params.SBRTEMPLATE)) { params.sbrat[0] = segment_data[offset]; params.sbrat[1] = segment_data[offset + 1]; @@ -565,6 +571,8 @@ jbig2_text_region(Jbig2Ctx *ctx, Jbig2Segment *segment, const byte *segment_data } /* 7.4.3.1.4 */ + if (segment->data_length - offset < 4) + goto too_short; params.SBNUMINSTANCES = jbig2_get_uint32(segment_data + offset); offset += 4; @@ -831,6 +839,8 @@ jbig2_text_region(Jbig2Ctx *ctx, Jbig2Segment *segment, const byte *segment_data goto cleanup2; } + if (offset >= segment->data_length) + goto too_short; ws = jbig2_word_stream_buf_new(ctx, segment_data + offset, segment->data_length - offset); if (ws == NULL) { code = jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number, "couldn't allocate ws in text region image"); |