shithub: jbig2

Download patch

ref: ec60c3ff44b9f8e48a15a568de3ba7014adeb2d7
parent: a5096e4aff40b226ee4ac8519edf2615b07fe667
author: Alex Cherepanov <alex.cherepanov@artifex.com>
date: Sat Jan 26 20:46:17 EST 2013 

Bug 693513: Detect and reject negative parameters.

Fix detection of negative width and height attributes.
Add detection of negative number of dictionary symbols.


--- a/jbig2_symbol_dict.c
+++ b/jbig2_symbol_dict.c
@@ -96,6 +96,12 @@
 {
    Jbig2SymbolDict *new = NULL;
 
+   if (n_symbols < 0) {
+     jbig2_error(ctx, JBIG2_SEVERITY_FATAL, -1,
+         "Negative number of symbols in symbol dict: %d", n_symbols);
+     return NULL;
+   }
+
    new = jbig2_new(ctx, Jbig2SymbolDict, 1);
    if (new != NULL) {
      new->glyphs = jbig2_new(ctx, Jbig2Image*, n_symbols);
@@ -359,7 +365,7 @@
       TOTWIDTH = 0;
       HCFIRSTSYM = NSYMSDECODED;
 
-      if (HCHEIGHT < 0) {
+      if ((int32_t)HCHEIGHT < 0) {
           code = jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,
               "Invalid HCHEIGHT value");
           goto cleanup2;
@@ -397,7 +403,7 @@
 
 	  SYMWIDTH = SYMWIDTH + DW;
 	  TOTWIDTH = TOTWIDTH + SYMWIDTH;
-	  if (SYMWIDTH < 0) {
+	  if ((int32_t)SYMWIDTH < 0) {
           code = jbig2_error(ctx, JBIG2_SEVERITY_FATAL, segment->number,
               "Invalid SYMWIDTH value (%d) at symbol %d", SYMWIDTH, NSYMSDECODED+1);
           goto cleanup4;