fofi/FoFiBase.cc | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
New commits: commit 8d0765e957f456725c39435d4ad395ad2f2518b4 Author: Albert Astals Cid <[email protected]> Date: Sun Oct 18 19:46:20 2020 +0200 Switch the order of the checks to check for overflow first oss-fuzz/26481 diff --git a/fofi/FoFiBase.cc b/fofi/FoFiBase.cc index 2005be19..ad14df63 100644 --- a/fofi/FoFiBase.cc +++ b/fofi/FoFiBase.cc @@ -15,7 +15,7 @@ // // Copyright (C) 2008 Ed Avis <[email protected]> // Copyright (C) 2011 Jim Meyering <[email protected]> -// Copyright (C) 2016, 2018 Albert Astals Cid <[email protected]> +// Copyright (C) 2016, 2018, 2020 Albert Astals Cid <[email protected]> // Copyright (C) 2019 Christian Persch <[email protected]> // Copyright (C) 2019 LE GARREC Vincent <[email protected]> // @@ -116,7 +116,7 @@ int FoFiBase::getS16BE(int pos, bool *ok) const { int x; - if (pos < 0 || pos + 1 >= len || pos > INT_MAX - 1) { + if (pos < 0 || pos > INT_MAX - 1 || pos + 1 >= len) { *ok = false; return 0; } @@ -132,7 +132,7 @@ int FoFiBase::getU16BE(int pos, bool *ok) const { int x; - if (pos < 0 || pos + 1 >= len || pos > INT_MAX - 1) { + if (pos < 0 || pos > INT_MAX - 1 || pos + 1 >= len) { *ok = false; return 0; } @@ -145,7 +145,7 @@ int FoFiBase::getS32BE(int pos, bool *ok) const { int x; - if (pos < 0 || pos + 3 >= len || pos > INT_MAX - 3) { + if (pos < 0 || pos > INT_MAX - 3 || pos + 3 >= len) { *ok = false; return 0; } @@ -163,7 +163,7 @@ unsigned int FoFiBase::getU32BE(int pos, bool *ok) const { unsigned int x; - if (pos < 0 || pos + 3 >= len || pos > INT_MAX - 3) { + if (pos < 0 || pos > INT_MAX - 3 || pos + 3 >= len) { *ok = false; return 0; } @@ -178,7 +178,7 @@ unsigned int FoFiBase::getU32LE(int pos, bool *ok) const { unsigned int x; - if (pos < 0 || pos + 3 >= len || pos > INT_MAX - 3) { + if (pos < 0 || pos > INT_MAX - 3 || pos + 3 >= len) { *ok = false; return 0; } @@ -194,7 +194,7 @@ unsigned int FoFiBase::getUVarBE(int pos, int size, bool *ok) const unsigned int x; int i; - if (pos < 0 || pos + size > len || pos > INT_MAX - size) { + if (pos < 0 || pos > INT_MAX - size || pos + size > len) { *ok = false; return 0; } _______________________________________________ poppler mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/poppler
