commit 5e3b976529f18deb389ed608da88b895eb115d72
author Dan Sinclair <dsinclair@chromium.org> Tue Jan 03 14:57:14 2017 -0500
committer Chromium commit bot <commit-bot@chromium.org> Tue Jan 03 21:07:51 2017 +0000
tree b5c37c4957fc053d677ec75a021f95e3a3c3afdf
parent fa07af3e9b8fe849c973dd62f718ebb6bb4017c7

Check for overflow in JBig2 Huffman decoder

This CL updates the Huffman decoder in the JBig2 codex to check the low field
does not overflow.

BUG=chromium:675236

Change-Id: I7f5f6fe8329df4ece6f317fac521fe2373686479
Reviewed-on: https://pdfium-review.googlesource.com/2131
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>

core/fxcodec/jbig2/JBig2_HuffmanTable.cpp

diff --git a/core/fxcodec/jbig2/JBig2_HuffmanTable.cpp b/core/fxcodec/jbig2/JBig2_HuffmanTable.cpp
index 26f0e52..baf9756 100644
--- a/core/fxcodec/jbig2/JBig2_HuffmanTable.cpp
+++ b/core/fxcodec/jbig2/JBig2_HuffmanTable.cpp
@@ -13,6 +13,7 @@
 #include "core/fxcodec/jbig2/JBig2_Define.h"
 #include "core/fxcodec/jbig2/JBig2_HuffmanTable_Standard.h"
 #include "core/fxcrt/fx_memory.h"
+#include "third_party/base/numerics/safe_math.h"
 
 CJBig2_HuffmanTable::CJBig2_HuffmanTable(const JBig2TableLine* pTable,
                                          uint32_t nLines,
@@ -61,17 +62,19 @@
     return false;
 
   ExtendBuffers(false);
-  int cur_low = low;
+  pdfium::base::CheckedNumeric<int> cur_low = low;
   do {
     if ((pStream->readNBits(HTPS, &PREFLEN[NTEMP]) == -1) ||
         (pStream->readNBits(HTRS, &RANGELEN[NTEMP]) == -1) ||
         (static_cast<size_t>(RANGELEN[NTEMP]) >= 8 * sizeof(cur_low))) {
       return false;
     }
-    RANGELOW[NTEMP] = cur_low;
+    RANGELOW[NTEMP] = cur_low.ValueOrDie();
     cur_low += (1 << RANGELEN[NTEMP]);
+    if (!cur_low.IsValid())
+      return false;
     ExtendBuffers(true);
-  } while (cur_low < high);
+  } while (cur_low.ValueOrDie() < high);
 
   if (pStream->readNBits(HTPS, &PREFLEN[NTEMP]) == -1)
     return false;