poppler/SplashOutputDev.cc | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
New commits: commit cf25cd0c4893b62a9993034079a6c89c6ca370ee Author: Albert Astals Cid <[email protected]> Date: Thu Sep 20 23:17:06 2018 +0200 SplashOutputDev::drawSoftMaskedImage: gmallocn -> gmallocn_checkoverflow oss-fuzz/10298 diff --git a/poppler/SplashOutputDev.cc b/poppler/SplashOutputDev.cc index a8e31fff..371fc976 100644 --- a/poppler/SplashOutputDev.cc +++ b/poppler/SplashOutputDev.cc @@ -4069,14 +4069,16 @@ void SplashOutputDev::drawSoftMaskedImage(GfxState *state, Object *ref, } break; case splashModeXBGR8: - imgData.lookup = (SplashColorPtr)gmallocn(n, 4); - for (i = 0; i < n; ++i) { - pix = (Guchar)i; - colorMap->getRGB(&pix, &rgb); - imgData.lookup[4*i] = colToByte(rgb.r); - imgData.lookup[4*i+1] = colToByte(rgb.g); - imgData.lookup[4*i+2] = colToByte(rgb.b); - imgData.lookup[4*i+3] = 255; + imgData.lookup = (SplashColorPtr)gmallocn_checkoverflow(n, 4); + if (imgData.lookup) { + for (i = 0; i < n; ++i) { + pix = (Guchar)i; + colorMap->getRGB(&pix, &rgb); + imgData.lookup[4*i] = colToByte(rgb.r); + imgData.lookup[4*i+1] = colToByte(rgb.g); + imgData.lookup[4*i+2] = colToByte(rgb.b); + imgData.lookup[4*i+3] = 255; + } } break; #ifdef SPLASH_CMYK _______________________________________________ poppler mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/poppler
