summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAlbert Astals Cid <aacid@kde.org>2013-01-10 20:29:06 +0100
committerAlbert Astals Cid <aacid@kde.org>2013-01-10 20:29:32 +0100
commit0388837f01bc467045164f9ddaff787000a8caaa (patch)
tree63439e4238866e2b8550e60605be00d0333380f6
parent957aa252912cde85d76c41e9710b33425a82b696 (diff)
Fix another invalid memory access in 1091.pdf.asan.72.42
-rw-r--r--poppler/Stream.cc10
1 files changed, 8 insertions, 2 deletions
diff --git a/poppler/Stream.cc b/poppler/Stream.cc
index d118dddf..4cb3326e 100644
--- a/poppler/Stream.cc
+++ b/poppler/Stream.cc
@@ -2387,7 +2387,8 @@ GBool CCITTFaxStream::isBinary(GBool last) {
// clip [-256,511] --> [0,255]
#define dctClipOffset 256
-static Guchar dctClip[768];
+#define dctClipLength 768
+static Guchar dctClip[dctClipLength];
static int dctClipInit = 0;
// zig zag decode map
@@ -3343,7 +3344,12 @@ void DCTStream::transformDataUnit(Gushort *quantTable,
// convert to 8-bit integers
for (i = 0; i < 64; ++i) {
- dataOut[i] = dctClip[dctClipOffset + 128 + ((dataIn[i] + 8) >> 4)];
+ const int ix = dctClipOffset + 128 + ((dataIn[i] + 8) >> 4);
+ if (unlikely(ix < 0 || ix >= dctClipLength)) {
+ dataOut[i] = 0;
+ } else {
+ dataOut[i] = dctClip[ix];
+ }
}
}