diff options
author | Robin Watts <Robin.Watts@artifex.com> | 2020-09-25 13:19:48 +0100 |
---|---|---|
committer | Robin Watts <Robin.Watts@artifex.com> | 2020-09-25 15:37:20 +0100 |
commit | af1e390a2c7abceb32676ec684cd1dbb92907ce8 (patch) | |
tree | 78f0da3141593106890255b0eda91b10a4c479f2 | |
parent | f83d93f12ae5143a45da6b09c34486734fbf0bab (diff) |
Bug 702857: Detect/avoid overflow when calculating sizes of pixmaps.
Throw an error when trying to allocate an overly large pixmap.
-rw-r--r-- | source/fitz/pixmap.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/source/fitz/pixmap.c b/source/fitz/pixmap.c index f847a7473..66873d214 100644 --- a/source/fitz/pixmap.c +++ b/source/fitz/pixmap.c @@ -76,12 +76,12 @@ fz_new_pixmap_with_data(fz_context *ctx, fz_colorspace *colorspace, int w, int h } pix->samples = samples; - if (!samples) + if (!samples && pix->h > 0 && pix->w > 0) { fz_try(ctx) { - if (pix->stride - 1 > INT_MAX / pix->n) - fz_throw(ctx, FZ_ERROR_GENERIC, "overly wide image"); + if (pix->stride > INT_MAX / pix->h) + fz_throw(ctx, FZ_ERROR_GENERIC, "Overly large image"); pix->samples = Memento_label(fz_malloc(ctx, pix->h * pix->stride), "pixmap_data"); } fz_catch(ctx) @@ -102,8 +102,12 @@ fz_new_pixmap(fz_context *ctx, fz_colorspace *colorspace, int w, int h, fz_separ { int stride; int s = fz_count_active_separations(ctx, seps); + int n; if (!colorspace && s == 0) alpha = 1; - stride = (fz_colorspace_n(ctx, colorspace) + s + alpha) * w; + n = fz_colorspace_n(ctx, colorspace) + s + alpha; + if (w > INT_MAX / n) + fz_throw(ctx, FZ_ERROR_GENERIC, "Overly wide image"); + stride = n * w; return fz_new_pixmap_with_data(ctx, colorspace, w, h, seps, alpha, stride, NULL); } |