Verify value of prec before using
The fx_codec_jpx_opj code will attempt to do a 1 << (prec - 1). If the prec
value is >=32 then that shift will overflow the int value. This CL adds a check
that prec is < 32 before attempting the shift.
BUG=chromium:633208
Review-Url: https://codereview.chromium.org/2334823002
diff --git a/core/fxcodec/codec/fx_codec_jpx_opj.cpp b/core/fxcodec/codec/fx_codec_jpx_opj.cpp
index ed93319..a1c38d0 100644
--- a/core/fxcodec/codec/fx_codec_jpx_opj.cpp
+++ b/core/fxcodec/codec/fx_codec_jpx_opj.cpp
@@ -231,6 +231,9 @@
return;
int prec = img->comps[0].prec;
+ if (prec <= 0 || prec >= 32)
+ return;
+
int offset = 1 << (prec - 1);
int upb = (1 << prec) - 1;