shithub: jbig2

Info  •  Files  •  Log

jbig2_hd_new(): return error if params->GRAYMAX is large enough that N wraps to zero.

This was noticed when investigating coverity warnings about params->GRAYMAX
being tainted.

--- a/jbig2_halftone.c

+++ b/jbig2_halftone.c

@@ -50,6 +50,12 @@

     uint32_t i;

     int j;

+    if (N == 0) {

+        /* We've wrapped. */

+        jbig2_error(ctx, JBIG2_SEVERITY_WARNING, -1, "params->GRAYMAX out of range");

+        return NULL;

+    }

+

     /* allocate a new struct */

     new = jbig2_new(ctx, Jbig2PatternDict, 1);

     if (new != NULL) {