Attachment #134985 for bug #196735




  columns = columnsA;
  if (columns < 1) {
    columns = 1;
  } else if (columns > INT_MAX - 2) {
    columns = INT_MAX - 2;
    columns = INT_MAX - 4;
  }
  rows = rowsA;
  endOfBlock = endOfBlockA;
  black = blackA;
  // 0 <= codingLine[0] < codingLine[1] < ... < codingLine[n] = columns
  // ---> max codingLine size = columns + 1
  // refLine has one extra guard entry at the end
  // ---> max refLine size = columns + 2
  codingLine = (int *)gmallocn(columns + 1, sizeof(int));
  refLine = (int *)gmallocn(columns + 2, sizeof(int));

  eof = gFalse;
  row = 0;
  nextLine2D = encoding < 0;
  inputBits = 0;
  codingLine[0] = columns;
  a0i = 0;
  outputBits = 0;

  buf = EOF;
}

  row = 0;
  nextLine2D = encoding < 0;
  inputBits = 0;
  codingLine[0] = columns;
  a0i = 0;
  outputBits = 0;
  buf = EOF;

  // skip any initial zero bits and end-of-line marker, and get the 2D

  }
}

inline void CCITTFaxStream::addPixels(int a1, int blackPixels) {
  if (a1 > codingLine[a0i]) {
    if (a1 > columns) {
      error(getPos(), "CCITTFax row is wrong length (%d)", a1);
      err = gTrue;
      a1 = columns;
    }
    if ((a0i & 1) ^ blackPixels) {
      ++a0i;
    }
    codingLine[a0i] = a1;
  }
}

inline void CCITTFaxStream::addPixelsNeg(int a1, int blackPixels) {
  if (a1 > codingLine[a0i]) {
    if (a1 > columns) {
      error(getPos(), "CCITTFax row is wrong length (%d)", a1);
      err = gTrue;
      a1 = columns;
    }
    if ((a0i & 1) ^ blackPixels) {
      ++a0i;
    }
    codingLine[a0i] = a1;
  } else if (a1 < codingLine[a0i]) {
    if (a1 < 0) {
      error(getPos(), "Invalid CCITTFax code");
      err = gTrue;
      a1 = 0;
    }
    while (a0i > 0 && a1 <= codingLine[a0i - 1]) {
      --a0i;
    }
    codingLine[a0i] = a1;
  }
}

int CCITTFaxStream::lookChar() {
  short code1, code2, code3;
  int b1i, blackPixels, i, bits;
  GBool gotEOL;
  int ret;
  int bits, i;

  if (buf != EOF) {
    return buf;
    return EOF;
  }

  // read the next row
  if (outputBits == 0) {

    // if at eof just return EOF
    if (eof) {
      return EOF;
    }

    err = gFalse;

    // 2-D encoding
    if (nextLine2D) {
      // state:
      //   a0New = current position in coding line (0 <= a0New <= columns)
      //   codingLine[a0] = last change in coding line
      //                    (black-to-white if a0 is even,
      //                     white-to-black if a0 is odd)
      //   refLine[b1] = next change in reference line of opposite color
      //                 to a0
      // invariants:
      //   0 <= codingLine[a0] <= a0New
      //           <= refLine[b1] <= refLine[b1+1] <= columns
      //   0 <= a0 <= columns+1
      //   refLine[0] = 0
      //   refLine[n] = refLine[n+1] = columns
      //     -- for some 1 <= n <= columns+1
      // end condition:
      //   0 = codingLine[0] <= codingLine[1] < codingLine[2] < ...
      //     < codingLine[n-1] < codingLine[n] = columns
      //     -- where 1 <= n <= columns+1
      for (i = 0; codingLine[i] < columns; ++i) {
	refLine[i] = codingLine[i];
      }
      refLine[i++] = columns;
      refLine[i] = columns;
      codingLine[0] = 0;
      a0i = 0;
      b1i = 0;
      blackPixels = 0;
      // invariant:
      // refLine[b1i-1] <= codingLine[a0i] < refLine[b1i] < refLine[b1i+1]
      //                                                             <= columns
      // exception at left edge:
      //   codingLine[a0i = 0] = refLine[b1i = 0] = 0 is possible
      // exception at right edge:
      //   refLine[b1i] = refLine[b1i+1] = columns is possible
      while (codingLine[a0i] < columns) {
	code1 = getTwoDimCode();
	switch (code1) {
	case twoDimPass:
	  addPixels(refLine[b1i + 1], blackPixels);
	  if (refLine[b1i + 1] < columns) {
	    b1i += 2;
	  }
	  break;
	case twoDimHoriz:
	  code1 = code2 = 0;
	  if (blackPixels) {
	    do {
	      code1 += code3 = getBlackCode();
	    } while (code3 >= 64);
	    do {
	      code2 += code3 = getWhiteCode();
	    } while (code3 >= 64);
	  } else {
	    code1 = code2 = 0;
	    do {
	      code1 += code3 = getWhiteCode();
	    } while (code3 >= 64);
	    do {
	      code2 += code3 = getBlackCode();
	    } while (code3 >= 64);
	  }
	  addPixels(codingLine[a0i] + code1, blackPixels);
	  if (codingLine[a0i] < columns) {
	    addPixels(codingLine[a0i] + code2, blackPixels ^ 1);
	  }
	  while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
	    b1i += 2;
	  }
	  break;
	case twoDimVertR3:
	  addPixels(refLine[b1i] + 3, blackPixels);
	  blackPixels ^= 1;
	  if (codingLine[a0i] < columns) {
	    ++b1i;
	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
	      b1i += 2;
	      b1 += 2;
	    }
	  }
	  break;
	case twoDimVertR2:
	  addPixels(refLine[b1i] + 2, blackPixels);
	  blackPixels ^= 1;
	  if (codingLine[a0i] < columns) {
	    ++b1i;
	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
	      b1i += 2;
	    }
	  } else {
	    a0New = codingLine[++a0] = columns;
	  }
	  break;
	case twoDimVertR1:
	  addPixels(refLine[b1i] + 1, blackPixels);
	  blackPixels ^= 1;
	  if (codingLine[a0i] < columns) {
	    ++b1i;
	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
	      b1i += 2;
	    }
	  } else {
	    a0New = codingLine[++a0] = columns;
	  }
	  break;
	case twoDimVert0:
	  addPixels(refLine[b1i], blackPixels);
	  blackPixels ^= 1;
	  if (codingLine[a0i] < columns) {
	    ++b1i;
	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
	      b1i += 2;
	    }
	  }
	  break;
	case twoDimVertL3:
	  addPixelsNeg(refLine[b1i] - 3, blackPixels);
	  blackPixels ^= 1;
	  if (codingLine[a0i] < columns) {
	    if (b1i > 0) {
	      --b1i;
	    } else {
	      ++b1i;
	    }
	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
	      b1i += 2;
	    }
	  } else {
	    a0New = codingLine[++a0] = columns;
	  }
	  break;
	case twoDimVertL2:
	  addPixelsNeg(refLine[b1i] - 2, blackPixels);
	  blackPixels ^= 1;
	  if (codingLine[a0i] < columns) {
	    if (b1i > 0) {
	      --b1i;
	    } else {
	      ++b1i;
	    }
	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
	      b1i += 2;
	case twoDimVertR3:
	  if (refLine[b1] + 3 < columns) {
	    a0New = codingLine[++a0] = refLine[b1] + 3;
	    ++b1;
	    while (refLine[b1] <= a0New && refLine[b1] < columns) {
	      b1 += 2;
	    }
	  } else {
	    a0New = codingLine[++a0] = columns;
	  }
	  break;
	case twoDimVertL1:
	  addPixelsNeg(refLine[b1i] - 1, blackPixels);
	  blackPixels ^= 1;
	  if (codingLine[a0i] < columns) {
	    if (b1i > 0) {
	      --b1i;
	    } else {
	      ++b1i;
	    }
	    while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
	      b1i += 2;
	    }
	  }
	  break;
	case EOF:
	  addPixels(columns, 0);
	  eof = gTrue;
	  break;
	  return EOF;
	default:
	  error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1);
	  addPixels(columns, 0);
	  err = gTrue;
	  break;
	}
      }

    // 1-D encoding
    } else {
      codingLine[0] = 0;
      a0i = 0;
      blackPixels = 0;
      while (codingLine[a0i] < columns) {
	code1 = 0;
	if (blackPixels) {
	  do {
	    code1 += code3 = getBlackCode();
	  } while (code3 >= 64);
	} else {
	  do {
	    code1 += code3 = getWhiteCode();
	  } while (code3 >= 64);
	code2 = 0;
	do {
	  code2 += code3 = getBlackCode();
	} while (code3 >= 64);
	codingLine[a0+1] = codingLine[a0] + code2;
	++a0;
	if (codingLine[a0] >= columns) {
	  break;
	}
	addPixels(codingLine[a0i] + code1, blackPixels);
	blackPixels ^= 1;
      }
    }

    if (codingLine[a0] != columns) {
      error(getPos(), "CCITTFax row is wrong length (%d)", codingLine[a0]);
      // force the row to be the correct length
      while (codingLine[a0] > columns) {
	--a0;
      }
      codingLine[++a0] = columns;
      err = gTrue;
    }

    // byte-align the row
    if (byteAlign) {
      inputBits &= ~7;

    // this if we know the stream contains end-of-line markers because
    // the "just plow on" technique tends to work better otherwise
    } else if (err && endOfLine) {
      while (1) {
	code1 = lookBits(13);
	if (code1 == EOF) {
	  eof = gTrue;
	  return EOF;
	}
	if ((code1 >> 1) == 0x001) {
	  break;
	}
	eatBits(1);
      }
      } while ((code1 >> 1) != 0x001);
      eatBits(12); 
      if (encoding > 0) {
	eatBits(1);

      }
    }

    // set up for output
    if (codingLine[0] > 0) {
      outputBits = codingLine[a0i = 0];
    } else {
      outputBits = codingLine[a0i = 1];
    }

    ++row;


  // get a byte
  if (outputBits >= 8) {
    buf = (a0i & 1) ? 0x00 : 0xff;
    outputBits -= 8;
    if (outputBits == 0 && codingLine[a0i] < columns) {
      ++a0i;
      outputBits = codingLine[a0i] - codingLine[a0i - 1];
      }
    }
  } else {
    bits = 8;
    buf = 0;
    do {
      if (outputBits > bits) {
	buf <<= bits;
	if (!(a0i & 1)) {
	  buf |= 0xff >> (8 - bits);
	  ret |= 0xff >> (8 - i);
	}
	outputBits -= bits;
	bits = 0;
      } else {
	buf <<= outputBits;
	if (!(a0i & 1)) {
	  buf |= 0xff >> (8 - outputBits);
	  ret |= (0xff >> (8 - i)) << bits;
	}
	bits -= outputBits;
	outputBits = 0;
	if (codingLine[a0i] < columns) {
	  ++a0i;
	  outputBits = codingLine[a0i] - codingLine[a0i - 1];
	} else if (bits > 0) {
	  buf <<= bits;
	  bits = 0;
	}
      }
    } while (bits);
  }
  if (black) {
    buf ^= 0xff;
  }
  buf = black ? (ret ^ 0xff) : ret;
  return buf;
}


  code = 0; // make gcc happy
  if (endOfBlock) {
    code = lookBits(12);
    if (code == EOF) {
      return 1;
    }
    if ((code >> 5) == 0) {
      p = &whiteTab1[code];
    } else {

  } else {
    for (n = 1; n <= 9; ++n) {
      code = lookBits(n);
      if (code == EOF) {
	return 1;
      }
      if (n < 9) {
	code <<= 9 - n;
      }

    }
    for (n = 11; n <= 12; ++n) {
      code = lookBits(n);
      if (code == EOF) {
	return 1;
      }
      if (n < 12) {
	code <<= 12 - n;
      }

  code = 0; // make gcc happy
  if (endOfBlock) {
    code = lookBits(13);
    if (code == EOF) {
      return 1;
    }
    if ((code >> 7) == 0) {
      p = &blackTab1[code];
    } else if ((code >> 9) == 0 && (code >> 7) != 0) {

  } else {
    for (n = 2; n <= 6; ++n) {
      code = lookBits(n);
      if (code == EOF) {
	return 1;
      }
      if (n < 6) {
	code <<= 6 - n;
      }

    }
    for (n = 7; n <= 12; ++n) {
      code = lookBits(n);
      if (code == EOF) {
	return 1;
      }
      if (n < 12) {
	code <<= 12 - n;
      }

    }
    for (n = 10; n <= 13; ++n) {
      code = lookBits(n);
      if (code == EOF) {
	return 1;
      }
      if (n < 13) {
	code <<= 13 - n;
      }

    // allocate a buffer for the whole image
    bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth;
    bufHeight = ((height + mcuHeight - 1) / mcuHeight) * mcuHeight;
    if (bufWidth <= 0 || bufHeight <= 0 ||
	bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) {
      error(getPos(), "Invalid image size in DCT stream");
      y = height;
      return;
    }
    for (i = 0; i < numComps; ++i) {
      frameBuf[i] = (int *)gmallocn(bufWidth * bufHeight, sizeof(int));
      memset(frameBuf[i], 0, bufWidth * bufHeight * sizeof(int));

  }
  scanInfo.firstCoeff = str->getChar();
  scanInfo.lastCoeff = str->getChar();
  if (scanInfo.firstCoeff < 0 || scanInfo.lastCoeff > 63 ||
      scanInfo.firstCoeff > scanInfo.lastCoeff) {
    error(getPos(), "Bad DCT coefficient numbers in scan info block");
    return gFalse;
  }
  c = str->getChar();
  scanInfo.ah = (c >> 4) & 0x0f;
  scanInfo.al = c & 0x0f;

Lines 526-538 private: Link Here

(-)Stream.h (-4 / +6 lines)
526	int row; // current row	526	int row; // current row
527	int inputBuf; // input buffer	527	int inputBuf; // input buffer
528	int inputBits; // number of bits in input buffer	528	int inputBits; // number of bits in input buffer
529	short *refLine; // reference line changing elements	529	int *codingLine; // coding line changing elements
530	int b1; // index into refLine	530	int *refLine; // reference line changing elements
531	short *codingLine; // coding line changing elements	531	int a0i; // index into codingLine
532	int a0; // index into codingLine	532	GBool err; // error on current line
533	int outputBits; // remaining ouput bits	533	int outputBits; // remaining ouput bits
534	int buf; // character buffer	534	int buf; // character buffer
535		535
		536	void addPixels(int a1, int black);
		537	void addPixelsNeg(int a1, int black);
536	short getTwoDimCode();	538	short getTwoDimCode();
537	short getWhiteCode();	539	short getWhiteCode();
538	short getBlackCode();	540	short getBlackCode();

Return to bug 196735

Lines 1251-1273 CCITTFaxStream::CCITTFaxStream(Stream *s Link Here

(-)Stream.cc (-178 / +239 lines)
1251	columns = columnsA;	1251	columns = columnsA;
1252	if (columns < 1) {	1252	if (columns < 1) {
1253	columns = 1;	1253	columns = 1;
1254	}	1254	} else if (columns > INT_MAX - 2) {
1255	if (columns + 4 <= 0) {	1255	columns = INT_MAX - 2;
1256	columns = INT_MAX - 4;
1257	}	1256	}
1258	rows = rowsA;	1257	rows = rowsA;
1259	endOfBlock = endOfBlockA;	1258	endOfBlock = endOfBlockA;
1260	black = blackA;	1259	black = blackA;
1261	refLine = (short *)gmallocn(columns + 3, sizeof(short));	1260	// 0 <= codingLine[0] < codingLine[1] < ... < codingLine[n] = columns
1262	codingLine = (short *)gmallocn(columns + 2, sizeof(short));	1261	// ---> max codingLine size = columns + 1
		1262	// refLine has one extra guard entry at the end
		1263	// ---> max refLine size = columns + 2
		1264	codingLine = (int *)gmallocn(columns + 1, sizeof(int));
		1265	refLine = (int *)gmallocn(columns + 2, sizeof(int));
1263		1266
1264	eof = gFalse;	1267	eof = gFalse;
1265	row = 0;	1268	row = 0;
1266	nextLine2D = encoding < 0;	1269	nextLine2D = encoding < 0;
1267	inputBits = 0;	1270	inputBits = 0;
1268	codingLine[0] = 0;	1271	codingLine[0] = columns;
1269	codingLine[1] = refLine[2] = columns;	1272	a0i = 0;
1270	a0 = 1;	1273	outputBits = 0;
1271		1274
1272	buf = EOF;	1275	buf = EOF;
1273	}	1276	}
Lines 1286-1294 void CCITTFaxStream::reset() { Link Here
1286	row = 0;	1289	row = 0;
1287	nextLine2D = encoding < 0;	1290	nextLine2D = encoding < 0;
1288	inputBits = 0;	1291	inputBits = 0;
1289	codingLine[0] = 0;	1292	codingLine[0] = columns;
1290	codingLine[1] = columns;	1293	a0i = 0;
1291	a0 = 1;	1294	outputBits = 0;
1292	buf = EOF;	1295	buf = EOF;
1293		1296
1294	// skip any initial zero bits and end-of-line marker, and get the 2D	1297	// skip any initial zero bits and end-of-line marker, and get the 2D
Lines 1305-1515 void CCITTFaxStream::reset() { Link Here
1305	}	1308	}
1306	}	1309	}
1307		1310
		1311	inline void CCITTFaxStream::addPixels(int a1, int blackPixels) {
		1312	if (a1 > codingLine[a0i]) {
		1313	if (a1 > columns) {
		1314	error(getPos(), "CCITTFax row is wrong length (%d)", a1);
		1315	err = gTrue;
		1316	a1 = columns;
		1317	}
		1318	if ((a0i & 1) ^ blackPixels) {
		1319	++a0i;
		1320	}
		1321	codingLine[a0i] = a1;
		1322	}
		1323	}
		1324
		1325	inline void CCITTFaxStream::addPixelsNeg(int a1, int blackPixels) {
		1326	if (a1 > codingLine[a0i]) {
		1327	if (a1 > columns) {
		1328	error(getPos(), "CCITTFax row is wrong length (%d)", a1);
		1329	err = gTrue;
		1330	a1 = columns;
		1331	}
		1332	if ((a0i & 1) ^ blackPixels) {
		1333	++a0i;
		1334	}
		1335	codingLine[a0i] = a1;
		1336	} else if (a1 < codingLine[a0i]) {
		1337	if (a1 < 0) {
		1338	error(getPos(), "Invalid CCITTFax code");
		1339	err = gTrue;
		1340	a1 = 0;
		1341	}
		1342	while (a0i > 0 && a1 <= codingLine[a0i - 1]) {
		1343	--a0i;
		1344	}
		1345	codingLine[a0i] = a1;
		1346	}
		1347	}
		1348
1308	int CCITTFaxStream::lookChar() {	1349	int CCITTFaxStream::lookChar() {
1309	short code1, code2, code3;	1350	short code1, code2, code3;
1310	int a0New;	1351	int b1i, blackPixels, i, bits;
1311	GBool err, gotEOL;	1352	GBool gotEOL;
1312	int ret;
1313	int bits, i;
1314		1353
1315	// if at eof just return EOF	1354	if (buf != EOF) {
1316	if (eof && codingLine[a0] >= columns) {	1355	return buf;
1317	return EOF;
1318	}	1356	}
1319		1357
1320	// read the next row	1358	// read the next row
1321	err = gFalse;	1359	if (outputBits == 0) {
1322	if (codingLine[a0] >= columns) {	1360
		1361	// if at eof just return EOF
		1362	if (eof) {
		1363	return EOF;
		1364	}
		1365
		1366	err = gFalse;
1323		1367
1324	// 2-D encoding	1368	// 2-D encoding
1325	if (nextLine2D) {	1369	if (nextLine2D) {
1326	// state:
1327	// a0New = current position in coding line (0 <= a0New <= columns)
1328	// codingLine[a0] = last change in coding line
1329	// (black-to-white if a0 is even,
1330	// white-to-black if a0 is odd)
1331	// refLine[b1] = next change in reference line of opposite color
1332	// to a0
1333	// invariants:
1334	// 0 <= codingLine[a0] <= a0New
1335	// <= refLine[b1] <= refLine[b1+1] <= columns
1336	// 0 <= a0 <= columns+1
1337	// refLine[0] = 0
1338	// refLine[n] = refLine[n+1] = columns
1339	// -- for some 1 <= n <= columns+1
1340	// end condition:
1341	// 0 = codingLine[0] <= codingLine[1] < codingLine[2] < ...
1342	// < codingLine[n-1] < codingLine[n] = columns
1343	// -- where 1 <= n <= columns+1
1344	for (i = 0; codingLine[i] < columns; ++i) {	1370	for (i = 0; codingLine[i] < columns; ++i) {
1345	refLine[i] = codingLine[i];	1371	refLine[i] = codingLine[i];
1346	}	1372	}
1347	refLine[i] = refLine[i + 1] = columns;	1373	refLine[i++] = columns;
1348	b1 = 1;	1374	refLine[i] = columns;
1349	a0New = codingLine[a0 = 0] = 0;	1375	codingLine[0] = 0;
1350	do {	1376	a0i = 0;
		1377	b1i = 0;
		1378	blackPixels = 0;
		1379	// invariant:
		1380	// refLine[b1i-1] <= codingLine[a0i] < refLine[b1i] < refLine[b1i+1]
		1381	// <= columns
		1382	// exception at left edge:
		1383	// codingLine[a0i = 0] = refLine[b1i = 0] = 0 is possible
		1384	// exception at right edge:
		1385	// refLine[b1i] = refLine[b1i+1] = columns is possible
		1386	while (codingLine[a0i] < columns) {
1351	code1 = getTwoDimCode();	1387	code1 = getTwoDimCode();
1352	switch (code1) {	1388	switch (code1) {
1353	case twoDimPass:	1389	case twoDimPass:
1354	if (refLine[b1] < columns) {	1390	addPixels(refLine[b1i + 1], blackPixels);
1355	a0New = refLine[b1 + 1];	1391	if (refLine[b1i + 1] < columns) {
1356	b1 += 2;	1392	b1i += 2;
1357	}	1393	}
1358	break;	1394	break;
1359	case twoDimHoriz:	1395	case twoDimHoriz:
1360	if ((a0 & 1) == 0) {	1396	code1 = code2 = 0;
1361	code1 = code2 = 0;	1397	if (blackPixels) {
1362	do {	1398	do {
1363	code1 += code3 = getWhiteCode();	1399	code1 += code3 = getBlackCode();
1364	} while (code3 >= 64);	1400	} while (code3 >= 64);
1365	do {	1401	do {
1366	code2 += code3 = getBlackCode();	1402	code2 += code3 = getWhiteCode();
1367	} while (code3 >= 64);	1403	} while (code3 >= 64);
1368	} else {	1404	} else {
1369	code1 = code2 = 0;
1370	do {	1405	do {
1371	code1 += code3 = getBlackCode();	1406	code1 += code3 = getWhiteCode();
1372	} while (code3 >= 64);	1407	} while (code3 >= 64);
1373	do {	1408	do {
1374	code2 += code3 = getWhiteCode();	1409	code2 += code3 = getBlackCode();
1375	} while (code3 >= 64);	1410	} while (code3 >= 64);
1376	}	1411	}
1377	if (code1 > 0 \|\| code2 > 0) {	1412	addPixels(codingLine[a0i] + code1, blackPixels);
1378	if (a0New + code1 <= columns) {	1413	if (codingLine[a0i] < columns) {
1379	codingLine[a0 + 1] = a0New + code1;	1414	addPixels(codingLine[a0i] + code2, blackPixels ^ 1);
1380	} else {	1415	}
1381	codingLine[a0 + 1] = columns;	1416	while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
1382	}	1417	b1i += 2;
1383	++a0;	1418	}
1384	if (codingLine[a0] + code2 <= columns) {	1419	break;
1385	codingLine[a0 + 1] = codingLine[a0] + code2;	1420	case twoDimVertR3:
1386	} else {	1421	addPixels(refLine[b1i] + 3, blackPixels);
1387	codingLine[a0 + 1] = columns;	1422	blackPixels ^= 1;
1388	}	1423	if (codingLine[a0i] < columns) {
1389	++a0;	1424	++b1i;
1390	a0New = codingLine[a0];	1425	while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
1391	while (refLine[b1] <= a0New && refLine[b1] < columns) {	1426	b1i += 2;
1392	b1 += 2;
1393	}	1427	}
1394	}	1428	}
1395	break;	1429	break;
1396	case twoDimVert0:	1430	case twoDimVertR2:
1397	if (refLine[b1] < columns) {	1431	addPixels(refLine[b1i] + 2, blackPixels);
1398	a0New = codingLine[++a0] = refLine[b1];	1432	blackPixels ^= 1;
1399	++b1;	1433	if (codingLine[a0i] < columns) {
1400	while (refLine[b1] <= a0New && refLine[b1] < columns) {	1434	++b1i;
1401	b1 += 2;	1435	while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
		1436	b1i += 2;
1402	}	1437	}
1403	} else {
1404	a0New = codingLine[++a0] = columns;
1405	}	1438	}
1406	break;	1439	break;
1407	case twoDimVertR1:	1440	case twoDimVertR1:
1408	if (refLine[b1] + 1 < columns) {	1441	addPixels(refLine[b1i] + 1, blackPixels);
1409	a0New = codingLine[++a0] = refLine[b1] + 1;	1442	blackPixels ^= 1;
1410	++b1;	1443	if (codingLine[a0i] < columns) {
1411	while (refLine[b1] <= a0New && refLine[b1] < columns) {	1444	++b1i;
1412	b1 += 2;	1445	while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
		1446	b1i += 2;
1413	}	1447	}
1414	} else {
1415	a0New = codingLine[++a0] = columns;
1416	}	1448	}
1417	break;	1449	break;
1418	case twoDimVertL1:	1450	case twoDimVert0:
1419	if (refLine[b1] - 1 > a0New \|\| (a0 == 0 && refLine[b1] == 1)) {	1451	addPixels(refLine[b1i], blackPixels);
1420	a0New = codingLine[++a0] = refLine[b1] - 1;	1452	blackPixels ^= 1;
1421	--b1;	1453	if (codingLine[a0i] < columns) {
1422	while (refLine[b1] <= a0New && refLine[b1] < columns) {	1454	++b1i;
1423	b1 += 2;	1455	while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
		1456	b1i += 2;
1424	}	1457	}
1425	}	1458	}
1426	break;	1459	break;
1427	case twoDimVertR2:	1460	case twoDimVertL3:
1428	if (refLine[b1] + 2 < columns) {	1461	addPixelsNeg(refLine[b1i] - 3, blackPixels);
1429	a0New = codingLine[++a0] = refLine[b1] + 2;	1462	blackPixels ^= 1;
1430	++b1;	1463	if (codingLine[a0i] < columns) {
1431	while (refLine[b1] <= a0New && refLine[b1] < columns) {	1464	if (b1i > 0) {
1432	b1 += 2;	1465	--b1i;
		1466	} else {
		1467	++b1i;
		1468	}
		1469	while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
		1470	b1i += 2;
1433	}	1471	}
1434	} else {
1435	a0New = codingLine[++a0] = columns;
1436	}	1472	}
1437	break;	1473	break;
1438	case twoDimVertL2:	1474	case twoDimVertL2:
1439	if (refLine[b1] - 2 > a0New \|\| (a0 == 0 && refLine[b1] == 2)) {	1475	addPixelsNeg(refLine[b1i] - 2, blackPixels);
1440	a0New = codingLine[++a0] = refLine[b1] - 2;	1476	blackPixels ^= 1;
1441	--b1;	1477	if (codingLine[a0i] < columns) {
1442	while (refLine[b1] <= a0New && refLine[b1] < columns) {	1478	if (b1i > 0) {
1443	b1 += 2;	1479	--b1i;
		1480	} else {
		1481	++b1i;
1444	}	1482	}
1445	}	1483	while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
1446	break;	1484	b1i += 2;
1447	case twoDimVertR3:
1448	if (refLine[b1] + 3 < columns) {
1449	a0New = codingLine[++a0] = refLine[b1] + 3;
1450	++b1;
1451	while (refLine[b1] <= a0New && refLine[b1] < columns) {
1452	b1 += 2;
1453	}	1485	}
1454	} else {
1455	a0New = codingLine[++a0] = columns;
1456	}	1486	}
1457	break;	1487	break;
1458	case twoDimVertL3:	1488	case twoDimVertL1:
1459	if (refLine[b1] - 3 > a0New \|\| (a0 == 0 && refLine[b1] == 3)) {	1489	addPixelsNeg(refLine[b1i] - 1, blackPixels);
1460	a0New = codingLine[++a0] = refLine[b1] - 3;	1490	blackPixels ^= 1;
1461	--b1;	1491	if (codingLine[a0i] < columns) {
1462	while (refLine[b1] <= a0New && refLine[b1] < columns) {	1492	if (b1i > 0) {
1463	b1 += 2;	1493	--b1i;
		1494	} else {
		1495	++b1i;
		1496	}
		1497	while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < columns) {
		1498	b1i += 2;
1464	}	1499	}
1465	}	1500	}
1466	break;	1501	break;
1467	case EOF:	1502	case EOF:
		1503	addPixels(columns, 0);
1468	eof = gTrue;	1504	eof = gTrue;
1469	codingLine[a0 = 0] = columns;	1505	break;
1470	return EOF;
1471	default:	1506	default:
1472	error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1);	1507	error(getPos(), "Bad 2D code %04x in CCITTFax stream", code1);
		1508	addPixels(columns, 0);
1473	err = gTrue;	1509	err = gTrue;
1474	break;	1510	break;
1475	}	1511	}
1476	} while (codingLine[a0] < columns);	1512	}
1477		1513
1478	// 1-D encoding	1514	// 1-D encoding
1479	} else {	1515	} else {
1480	codingLine[a0 = 0] = 0;	1516	codingLine[0] = 0;
1481	while (1) {	1517	a0i = 0;
		1518	blackPixels = 0;
		1519	while (codingLine[a0i] < columns) {
1482	code1 = 0;	1520	code1 = 0;
1483	do {	1521	if (blackPixels) {
1484	code1 += code3 = getWhiteCode();	1522	do {
1485	} while (code3 >= 64);	1523	code1 += code3 = getBlackCode();
1486	codingLine[a0+1] = codingLine[a0] + code1;	1524	} while (code3 >= 64);
1487	++a0;	1525	} else {
1488	if (codingLine[a0] >= columns) {	1526	do {
1489	break;	1527	code1 += code3 = getWhiteCode();
1490	}	1528	} while (code3 >= 64);
1491	code2 = 0;
1492	do {
1493	code2 += code3 = getBlackCode();
1494	} while (code3 >= 64);
1495	codingLine[a0+1] = codingLine[a0] + code2;
1496	++a0;
1497	if (codingLine[a0] >= columns) {
1498	break;
1499	}	1529	}
		1530	addPixels(codingLine[a0i] + code1, blackPixels);
		1531	blackPixels ^= 1;
1500	}	1532	}
1501	}	1533	}
1502		1534
1503	if (codingLine[a0] != columns) {
1504	error(getPos(), "CCITTFax row is wrong length (%d)", codingLine[a0]);
1505	// force the row to be the correct length
1506	while (codingLine[a0] > columns) {
1507	--a0;
1508	}
1509	codingLine[++a0] = columns;
1510	err = gTrue;
1511	}
1512
1513	// byte-align the row	1535	// byte-align the row
1514	if (byteAlign) {	1536	if (byteAlign) {
1515	inputBits &= ~7;	1537	inputBits &= ~7;
Lines 1568-1581 int CCITTFaxStream::lookChar() { Link Here
1568	// this if we know the stream contains end-of-line markers because	1590	// this if we know the stream contains end-of-line markers because
1569	// the "just plow on" technique tends to work better otherwise	1591	// the "just plow on" technique tends to work better otherwise
1570	} else if (err && endOfLine) {	1592	} else if (err && endOfLine) {
1571	do {	1593	while (1) {
		1594	code1 = lookBits(13);
1572	if (code1 == EOF) {	1595	if (code1 == EOF) {
1573	eof = gTrue;	1596	eof = gTrue;
1574	return EOF;	1597	return EOF;
1575	}	1598	}
		1599	if ((code1 >> 1) == 0x001) {
		1600	break;
		1601	}
1576	eatBits(1);	1602	eatBits(1);
1577	code1 = lookBits(13);	1603	}
1578	} while ((code1 >> 1) != 0x001);
1579	eatBits(12);	1604	eatBits(12);
1580	if (encoding > 0) {	1605	if (encoding > 0) {
1581	eatBits(1);	1606	eatBits(1);
Lines 1583-1593 int CCITTFaxStream::lookChar() { Link Here
1583	}	1608	}
1584	}	1609	}
1585		1610
1586	a0 = 0;	1611	// set up for output
1587	outputBits = codingLine[1] - codingLine[0];	1612	if (codingLine[0] > 0) {
1588	if (outputBits == 0) {	1613	outputBits = codingLine[a0i = 0];
1589	a0 = 1;	1614	} else {
1590	outputBits = codingLine[2] - codingLine[1];	1615	outputBits = codingLine[a0i = 1];
1591	}	1616	}
1592		1617
1593	++row;	1618	++row;
Lines 1595-1633 int CCITTFaxStream::lookChar() { Link Here
1595		1620
1596	// get a byte	1621	// get a byte
1597	if (outputBits >= 8) {	1622	if (outputBits >= 8) {
1598	ret = ((a0 & 1) == 0) ? 0xff : 0x00;	1623	buf = (a0i & 1) ? 0x00 : 0xff;
1599	if ((outputBits -= 8) == 0) {	1624	outputBits -= 8;
1600	++a0;	1625	if (outputBits == 0 && codingLine[a0i] < columns) {
1601	if (codingLine[a0] < columns) {	1626	++a0i;
1602	outputBits = codingLine[a0 + 1] - codingLine[a0];	1627	outputBits = codingLine[a0i] - codingLine[a0i - 1];
1603	}
1604	}	1628	}
1605	} else {	1629	} else {
1606	bits = 8;	1630	bits = 8;
1607	ret = 0;	1631	buf = 0;
1608	do {	1632	do {
1609	if (outputBits > bits) {	1633	if (outputBits > bits) {
1610	i = bits;	1634	buf <<= bits;
1611	bits = 0;	1635	if (!(a0i & 1)) {
1612	if ((a0 & 1) == 0) {	1636	buf \|= 0xff >> (8 - bits);
1613	ret \|= 0xff >> (8 - i);
1614	}	1637	}
1615	outputBits -= i;	1638	outputBits -= bits;
		1639	bits = 0;
1616	} else {	1640	} else {
1617	i = outputBits;	1641	buf <<= outputBits;
1618	bits -= outputBits;	1642	if (!(a0i & 1)) {
1619	if ((a0 & 1) == 0) {	1643	buf \|= 0xff >> (8 - outputBits);
1620	ret \|= (0xff >> (8 - i)) << bits;
1621	}	1644	}
		1645	bits -= outputBits;
1622	outputBits = 0;	1646	outputBits = 0;
1623	++a0;	1647	if (codingLine[a0i] < columns) {
1624	if (codingLine[a0] < columns) {	1648	++a0i;
1625	outputBits = codingLine[a0 + 1] - codingLine[a0];	1649	outputBits = codingLine[a0i] - codingLine[a0i - 1];
		1650	} else if (bits > 0) {
		1651	buf <<= bits;
		1652	bits = 0;
1626	}	1653	}
1627	}	1654	}
1628	} while (bits > 0 && codingLine[a0] < columns);	1655	} while (bits);
		1656	}
		1657	if (black) {
		1658	buf ^= 0xff;
1629	}	1659	}
1630	buf = black ? (ret ^ 0xff) : ret;
1631	return buf;	1660	return buf;
1632	}	1661	}
1633		1662
Lines 1669-1674 short CCITTFaxStream::getWhiteCode() { Link Here
1669	code = 0; // make gcc happy	1698	code = 0; // make gcc happy
1670	if (endOfBlock) {	1699	if (endOfBlock) {
1671	code = lookBits(12);	1700	code = lookBits(12);
		1701	if (code == EOF) {
		1702	return 1;
		1703	}
1672	if ((code >> 5) == 0) {	1704	if ((code >> 5) == 0) {
1673	p = &whiteTab1[code];	1705	p = &whiteTab1[code];
1674	} else {	1706	} else {
Lines 1681-1686 short CCITTFaxStream::getWhiteCode() { Link Here
1681	} else {	1713	} else {
1682	for (n = 1; n <= 9; ++n) {	1714	for (n = 1; n <= 9; ++n) {
1683	code = lookBits(n);	1715	code = lookBits(n);
		1716	if (code == EOF) {
		1717	return 1;
		1718	}
1684	if (n < 9) {	1719	if (n < 9) {
1685	code <<= 9 - n;	1720	code <<= 9 - n;
1686	}	1721	}
Lines 1692-1697 short CCITTFaxStream::getWhiteCode() { Link Here
1692	}	1727	}
1693	for (n = 11; n <= 12; ++n) {	1728	for (n = 11; n <= 12; ++n) {
1694	code = lookBits(n);	1729	code = lookBits(n);
		1730	if (code == EOF) {
		1731	return 1;
		1732	}
1695	if (n < 12) {	1733	if (n < 12) {
1696	code <<= 12 - n;	1734	code <<= 12 - n;
1697	}	1735	}
Lines 1717-1722 short CCITTFaxStream::getBlackCode() { Link Here
1717	code = 0; // make gcc happy	1755	code = 0; // make gcc happy
1718	if (endOfBlock) {	1756	if (endOfBlock) {
1719	code = lookBits(13);	1757	code = lookBits(13);
		1758	if (code == EOF) {
		1759	return 1;
		1760	}
1720	if ((code >> 7) == 0) {	1761	if ((code >> 7) == 0) {
1721	p = &blackTab1[code];	1762	p = &blackTab1[code];
1722	} else if ((code >> 9) == 0 && (code >> 7) != 0) {	1763	} else if ((code >> 9) == 0 && (code >> 7) != 0) {
Lines 1731-1736 short CCITTFaxStream::getBlackCode() { Link Here
1731	} else {	1772	} else {
1732	for (n = 2; n <= 6; ++n) {	1773	for (n = 2; n <= 6; ++n) {
1733	code = lookBits(n);	1774	code = lookBits(n);
		1775	if (code == EOF) {
		1776	return 1;
		1777	}
1734	if (n < 6) {	1778	if (n < 6) {
1735	code <<= 6 - n;	1779	code <<= 6 - n;
1736	}	1780	}
Lines 1742-1747 short CCITTFaxStream::getBlackCode() { Link Here
1742	}	1786	}
1743	for (n = 7; n <= 12; ++n) {	1787	for (n = 7; n <= 12; ++n) {
1744	code = lookBits(n);	1788	code = lookBits(n);
		1789	if (code == EOF) {
		1790	return 1;
		1791	}
1745	if (n < 12) {	1792	if (n < 12) {
1746	code <<= 12 - n;	1793	code <<= 12 - n;
1747	}	1794	}
Lines 1755-1760 short CCITTFaxStream::getBlackCode() { Link Here
1755	}	1802	}
1756	for (n = 10; n <= 13; ++n) {	1803	for (n = 10; n <= 13; ++n) {
1757	code = lookBits(n);	1804	code = lookBits(n);
		1805	if (code == EOF) {
		1806	return 1;
		1807	}
1758	if (n < 13) {	1808	if (n < 13) {
1759	code <<= 13 - n;	1809	code <<= 13 - n;
1760	}	1810	}
Lines 1971-1976 void DCTStream::reset() { Link Here
1971	// allocate a buffer for the whole image	2021	// allocate a buffer for the whole image
1972	bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth;	2022	bufWidth = ((width + mcuWidth - 1) / mcuWidth) * mcuWidth;
1973	bufHeight = ((height + mcuHeight - 1) / mcuHeight) * mcuHeight;	2023	bufHeight = ((height + mcuHeight - 1) / mcuHeight) * mcuHeight;
		2024	if (bufWidth <= 0 \|\| bufHeight <= 0 \|\|
		2025	bufWidth > INT_MAX / bufWidth / (int)sizeof(int)) {
		2026	error(getPos(), "Invalid image size in DCT stream");
		2027	y = height;
		2028	return;
		2029	}
1974	for (i = 0; i < numComps; ++i) {	2030	for (i = 0; i < numComps; ++i) {
1975	frameBuf[i] = (int )gmallocn(bufWidth bufHeight, sizeof(int));	2031	frameBuf[i] = (int )gmallocn(bufWidth bufHeight, sizeof(int));
1976	memset(frameBuf[i], 0, bufWidth * bufHeight * sizeof(int));	2032	memset(frameBuf[i], 0, bufWidth * bufHeight * sizeof(int));
Lines 3041-3046 GBool DCTStream::readScanInfo() { Link Here
3041	}	3097	}
3042	scanInfo.firstCoeff = str->getChar();	3098	scanInfo.firstCoeff = str->getChar();
3043	scanInfo.lastCoeff = str->getChar();	3099	scanInfo.lastCoeff = str->getChar();
		3100	if (scanInfo.firstCoeff < 0 \|\| scanInfo.lastCoeff > 63 \|\|
		3101	scanInfo.firstCoeff > scanInfo.lastCoeff) {
		3102	error(getPos(), "Bad DCT coefficient numbers in scan info block");
		3103	return gFalse;
		3104	}
3044	c = str->getChar();	3105	c = str->getChar();
3045	scanInfo.ah = (c >> 4) & 0x0f;	3106	scanInfo.ah = (c >> 4) & 0x0f;
3046	scanInfo.al = c & 0x0f;	3107	scanInfo.al = c & 0x0f;