poppler/Stream.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
New commits: commit db73587c566f8e50f03b24628e8948a558ee7039 Author: Albert Astals Cid <[email protected]> Date: Thu May 24 11:56:39 2018 +0200 StreamPredictor: move rowBytes calculation after overflow check fixes oss-fuzz/8498 diff --git a/poppler/Stream.cc b/poppler/Stream.cc index 4f075c12..f701789f 100644 --- a/poppler/Stream.cc +++ b/poppler/Stream.cc @@ -573,7 +573,6 @@ StreamPredictor::StreamPredictor(Stream *strA, int predictorA, nVals = width * nComps; pixBytes = (nComps * nBits + 7) >> 3; - rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; if (width <= 0 || nComps <= 0 || nBits <= 0 || nComps > gfxColorMaxComps || nBits > 16 || @@ -581,6 +580,7 @@ StreamPredictor::StreamPredictor(Stream *strA, int predictorA, nVals >= (INT_MAX - 7) / nBits) { // check for overflow in rowBytes return; } + rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes; predLine = (Guchar *)gmalloc(rowBytes); memset(predLine, 0, rowBytes); predIdx = rowBytes; _______________________________________________ poppler mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/poppler
