shithub: jbig2

Download patch

ref: 3b08883c63526aebe86715ff0e7551eb0dbe4468
parent: 6a010f34acdd98de7da5ba2dde41c3f9d6178bbb
author: Sebastian Rasmussen <sebras@gmail.com>
date: Tue Apr 10 20:02:39 EDT 2018

jbig2dec: Implement pixel out of field test for refinement regions too.

--- a/jbig2_refinement.c
+++ b/jbig2_refinement.c
@@ -40,6 +40,11 @@
 #include "jbig2_refinement.h"
 #include "jbig2_segment.h"
 
+#define pixel_outside_field(x, y) \
+    ((y) < -128 || (y) > 0 || (x) < -128 || ((y) < 0 && (x) > 127) || ((y) == 0 && (x) >= 0))
+#define refpixel_outside_field(x, y) \
+    ((y) < -128 || (y) > 127 || (x) < -128 || (x) > 127)
+
 static int
 jbig2_decode_refinement_template0_unopt(Jbig2Ctx *ctx,
                                         Jbig2Segment *segment,
@@ -55,6 +60,11 @@
     bool bit;
     int code = 0;
 
+    if (pixel_outside_field(params->grat[0], params->grat[1]) ||
+        refpixel_outside_field(params->grat[2], params->grat[3]))
+        return jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,
+                           "adaptive template pixel is out of field");
+
     for (y = 0; y < GRH; y++) {
         for (x = 0; x < GRW; x++) {
             CONTEXT = 0;
@@ -242,7 +252,9 @@
             (jbig2_image_get_pixel(ref, i + 1, j - 1) == m) &&
             (jbig2_image_get_pixel(ref, i - 1, j) == m) &&
             (jbig2_image_get_pixel(ref, i + 1, j) == m) &&
-            (jbig2_image_get_pixel(ref, i - 1, j + 1) == m) && (jbig2_image_get_pixel(ref, i, j + 1) == m) && (jbig2_image_get_pixel(ref, i + 1, j + 1) == m)
+            (jbig2_image_get_pixel(ref, i - 1, j + 1) == m) &&
+            (jbig2_image_get_pixel(ref, i, j + 1) == m) &&
+            (jbig2_image_get_pixel(ref, i + 1, j + 1) == m)
            )? m : -1;
 }
 
@@ -300,6 +312,12 @@
     uint32_t start_context = (params->GRTEMPLATE ? 0x40 : 0x100);
     ContextBuilder mkctx = (params->GRTEMPLATE ? mkctx1 : mkctx0);
     int code = 0;
+
+    if (params->GRTEMPLATE == 0 &&
+        (pixel_outside_field(params->grat[0], params->grat[1]) ||
+        refpixel_outside_field(params->grat[2], params->grat[3])))
+        return jbig2_error(ctx, JBIG2_SEVERITY_FATAL, -1,
+                           "adaptive template pixel is out of field");
 
     for (y = 0; y < GRH; y++) {
         LTP ^= jbig2_arith_decode(as, &GR_stats[start_context], &code);