summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRobin Watts <Robin.Watts@artifex.com>2020-09-25 13:19:48 +0100
committerRobin Watts <Robin.Watts@artifex.com>2020-09-25 15:37:20 +0100
commitaf1e390a2c7abceb32676ec684cd1dbb92907ce8 (patch)
tree78f0da3141593106890255b0eda91b10a4c479f2
parentf83d93f12ae5143a45da6b09c34486734fbf0bab (diff)
Bug 702857: Detect/avoid overflow when calculating sizes of pixmaps.
Throw an error when trying to allocate an overly large pixmap.
-rw-r--r--source/fitz/pixmap.c12
1 files changed, 8 insertions, 4 deletions
diff --git a/source/fitz/pixmap.c b/source/fitz/pixmap.c
index f847a7473..66873d214 100644
--- a/source/fitz/pixmap.c
+++ b/source/fitz/pixmap.c
@@ -76,12 +76,12 @@ fz_new_pixmap_with_data(fz_context *ctx, fz_colorspace *colorspace, int w, int h
}
pix->samples = samples;
- if (!samples)
+ if (!samples && pix->h > 0 && pix->w > 0)
{
fz_try(ctx)
{
- if (pix->stride - 1 > INT_MAX / pix->n)
- fz_throw(ctx, FZ_ERROR_GENERIC, "overly wide image");
+ if (pix->stride > INT_MAX / pix->h)
+ fz_throw(ctx, FZ_ERROR_GENERIC, "Overly large image");
pix->samples = Memento_label(fz_malloc(ctx, pix->h * pix->stride), "pixmap_data");
}
fz_catch(ctx)
@@ -102,8 +102,12 @@ fz_new_pixmap(fz_context *ctx, fz_colorspace *colorspace, int w, int h, fz_separ
{
int stride;
int s = fz_count_active_separations(ctx, seps);
+ int n;
if (!colorspace && s == 0) alpha = 1;
- stride = (fz_colorspace_n(ctx, colorspace) + s + alpha) * w;
+ n = fz_colorspace_n(ctx, colorspace) + s + alpha;
+ if (w > INT_MAX / n)
+ fz_throw(ctx, FZ_ERROR_GENERIC, "Overly wide image");
+ stride = n * w;
return fz_new_pixmap_with_data(ctx, colorspace, w, h, seps, alpha, stride, NULL);
}