shithub: jbig2

Info  •  Files  •  Log

Bug 697693: Prevent SEGV due to integer overflow.

While building a Huffman table, the start and end points were susceptible
to integer overflow.

Thank you to Jiaqi for finding this issue and suggesting a patch.

--- a/jbig2_huffman.c

+++ b/jbig2_huffman.c

@@ -421,8 +421,8 @@

             if (PREFLEN == CURLEN) {

                 int RANGELEN = lines[CURTEMP].RANGELEN;

-                int start_j = CURCODE << shift;

-                int end_j = (CURCODE + 1) << shift;

+                uint32_t start_j = CURCODE << shift;

+                uint32_t end_j = (CURCODE + 1) << shift;

                 byte eflags = 0;

                 if (end_j > max_j) {