diff options
author | Albert Astals Cid <aacid@kde.org> | 2013-01-10 20:29:06 +0100 |
---|---|---|
committer | Albert Astals Cid <aacid@kde.org> | 2013-01-10 20:29:32 +0100 |
commit | 0388837f01bc467045164f9ddaff787000a8caaa (patch) | |
tree | 63439e4238866e2b8550e60605be00d0333380f6 | |
parent | 957aa252912cde85d76c41e9710b33425a82b696 (diff) |
Fix another invalid memory access in 1091.pdf.asan.72.42
-rw-r--r-- | poppler/Stream.cc | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/poppler/Stream.cc b/poppler/Stream.cc index d118dddf..4cb3326e 100644 --- a/poppler/Stream.cc +++ b/poppler/Stream.cc @@ -2387,7 +2387,8 @@ GBool CCITTFaxStream::isBinary(GBool last) { // clip [-256,511] --> [0,255] #define dctClipOffset 256 -static Guchar dctClip[768]; +#define dctClipLength 768 +static Guchar dctClip[dctClipLength]; static int dctClipInit = 0; // zig zag decode map @@ -3343,7 +3344,12 @@ void DCTStream::transformDataUnit(Gushort *quantTable, // convert to 8-bit integers for (i = 0; i < 64; ++i) { - dataOut[i] = dctClip[dctClipOffset + 128 + ((dataIn[i] + 8) >> 4)]; + const int ix = dctClipOffset + 128 + ((dataIn[i] + 8) >> 4); + if (unlikely(ix < 0 || ix >= dctClipLength)) { + dataOut[i] = 0; + } else { + dataOut[i] = dctClip[ix]; + } } } |