poppler/Stream.cc | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
New commits: commit 2cf3cf58ed9f70b99e6ee93c57bb434a52a0e857 Author: Albert Astals Cid <[email protected]> Date: Thu Apr 27 11:50:45 2023 +0200 Check overflow in nvals correctly diff --git a/poppler/Stream.cc b/poppler/Stream.cc index 07720632..42d18880 100644 --- a/poppler/Stream.cc +++ b/poppler/Stream.cc @@ -14,7 +14,7 @@ // under GPL version 2 or later // // Copyright (C) 2005 Jeff Muizelaar <[email protected]> -// Copyright (C) 2006-2010, 2012-2014, 2016-2021 Albert Astals Cid <[email protected]> +// Copyright (C) 2006-2010, 2012-2014, 2016-2021, 2023 Albert Astals Cid <[email protected]> // Copyright (C) 2007 Krzysztof Kowalczyk <[email protected]> // Copyright (C) 2008 Julien Rebetez <[email protected]> // Copyright (C) 2009 Carlos Garcia Campos <[email protected]> @@ -728,9 +728,10 @@ StreamPredictor::StreamPredictor(Stream *strA, int predictorA, int widthA, int n predLine = nullptr; ok = false; - nVals = width * nComps; - if (width <= 0 || nComps <= 0 || nBits <= 0 || nComps > gfxColorMaxComps || nBits > 16 || width >= INT_MAX / nComps || // check for overflow in nVals - nVals >= (INT_MAX - 7) / nBits) { // check for overflow in rowBytes + if (checkedMultiply(width, nComps, &nVals)) { + return; + } + if (width <= 0 || nComps <= 0 || nBits <= 0 || nComps > gfxColorMaxComps || nBits > 16 || nVals >= (INT_MAX - 7) / nBits) { // check for overflow in rowBytes return; } pixBytes = (nComps * nBits + 7) >> 3;
