diff options
| author | Sebastian Rasmussen <sebras@gmail.com> | 2020-03-12 00:27:13 +0800 |
|---|---|---|
| committer | Sebastian Rasmussen <sebras@gmail.com> | 2020-03-20 20:49:02 +0800 |
| commit | f2613ed2159e8efc6b5b593e668a00d8bea9ace8 (patch) | |
| tree | 7e90c590c281a6b0a4d9179fc72a3c45aaaca55b /jbig2dec | |
| parent | ff53af0d4ff9291aa5039522f5553a2850dd569d (diff) | |
| download | ghostpdl-f2613ed2159e8efc6b5b593e668a00d8bea9ace8.tar.gz | |
jbig2dec: Use uint32_t when counting segments.
Diffstat (limited to 'jbig2dec')
| -rw-r--r-- | jbig2dec/jbig2.c | 11 | ||||
| -rw-r--r-- | jbig2dec/jbig2_priv.h | 6 |
2 files changed, 12 insertions, 5 deletions
diff --git a/jbig2dec/jbig2.c b/jbig2dec/jbig2.c index 9fbb3400a..323ea29dd 100644 --- a/jbig2dec/jbig2.c +++ b/jbig2dec/jbig2.c @@ -322,9 +322,17 @@ jbig2_data_in(Jbig2Ctx *ctx, const unsigned char *data, size_t size) return 0; /* need more data */ ctx->buf_rd_ix += header_size; - if (ctx->n_segments == ctx->n_segments_max) { + if (ctx->n_segments >= ctx->n_segments_max) { Jbig2Segment **segments; + if (ctx->n_segments_max == UINT32_MAX) { + ctx->state = JBIG2_FILE_EOF; + return jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number, "too many segments in jbig2 image"); + } + else if (ctx->n_segments_max > (UINT32_MAX >> 2)) { + ctx->n_segments_max = UINT32_MAX; + } + segments = jbig2_renew(ctx, ctx->segments, Jbig2Segment *, (ctx->n_segments_max <<= 2)); if (segments == NULL) { ctx->state = JBIG2_FILE_EOF; @@ -333,7 +341,6 @@ jbig2_data_in(Jbig2Ctx *ctx, const unsigned char *data, size_t size) ctx->segments = segments; } - ctx->segments[ctx->n_segments++] = segment; if (ctx->state == JBIG2_FILE_RANDOM_HEADERS) { if ((segment->flags & 63) == 51) /* end of file */ diff --git a/jbig2dec/jbig2_priv.h b/jbig2dec/jbig2_priv.h index d4642086f..08cd35734 100644 --- a/jbig2dec/jbig2_priv.h +++ b/jbig2dec/jbig2_priv.h @@ -94,10 +94,10 @@ struct _Jbig2Ctx { uint8_t file_header_flags; uint32_t n_pages; - int n_segments_max; + uint32_t n_segments_max; Jbig2Segment **segments; - int n_segments; /* index of last segment header parsed */ - int segment_index; /* index of last segment body parsed */ + uint32_t n_segments; /* index of last segment header parsed */ + uint32_t segment_index; /* index of last segment body parsed */ /* list of decoded pages, including the one in progress, currently stored as a contiguous, 0-indexed array. */ |