Attachment #192878 for bug #264603

Lines 55-61 void *gmalloc(int size) GMEM_EXCEP { Link Here

(-)xpdf-3.02.orig/goo/gmem.cc (-4 / +36 lines)
55	void *data;	55	void *data;
56	unsigned long trl, p;	56	unsigned long trl, p;
57		57
58	if (size <= 0) {	58	if (size < 0) {
		59	#if USE_EXCEPTIONS
		60	throw GMemException();
		61	#else
		62	fprintf(stderr, "Invalid memory allocation size\n");
		63	exit(1);
		64	#endif
		65	}
		66	if (size == 0) {
59	return NULL;	67	return NULL;
60	}	68	}
61	size1 = gMemDataSize(size);	69	size1 = gMemDataSize(size);
Lines 91-97 void *gmalloc(int size) GMEM_EXCEP { Link Here
91	#else	99	#else
92	void *p;	100	void *p;
93		101
94	if (size <= 0) {	102	if (size < 0) {
		103	#if USE_EXCEPTIONS
		104	throw GMemException();
		105	#else
		106	fprintf(stderr, "Invalid memory allocation size\n");
		107	exit(1);
		108	#endif
		109	}
		110	if (size == 0) {
95	return NULL;	111	return NULL;
96	}	112	}
97	if (!(p = malloc(size))) {	113	if (!(p = malloc(size))) {
Lines 112-118 void grealloc(void p, int size) GMEM_EXCEP { Link Here
112	void *q;	128	void *q;
113	int oldSize;	129	int oldSize;
114		130
115	if (size <= 0) {	131	if (size < 0) {
		132	#if USE_EXCEPTIONS
		133	throw GMemException();
		134	#else
		135	fprintf(stderr, "Invalid memory allocation size\n");
		136	exit(1);
		137	#endif
		138	}
		139	if (size == 0) {
116	if (p) {	140	if (p) {
117	gfree(p);	141	gfree(p);
118	}	142	}
Lines 131-137 void grealloc(void p, int size) GMEM_EXCEP { Link Here
131	#else	155	#else
132	void *q;	156	void *q;
133		157
134	if (size <= 0) {	158	if (size < 0) {
		159	#if USE_EXCEPTIONS
		160	throw GMemException();
		161	#else
		162	fprintf(stderr, "Invalid memory allocation size\n");
		163	exit(1);
		164	#endif
		165	}
		166	if (size == 0) {
135	if (p) {	167	if (p) {
136	free(p);	168	free(p);
137	}	169	}

Lines 422-433 void JBIG2HuffmanDecoder::buildTable(JBIG2HuffmanTable *table, Guint len) { Link Here

(-)xpdf-3.02.orig/xpdf/JBIG2Stream.cc (-142 / +327 lines)
422	table[i] = table[len];	422	table[i] = table[len];
423		423
424	// assign prefixes	424	// assign prefixes
425	i = 0;	425	if (table[0].rangeLen != jbig2HuffmanEOT) {
426	prefix = 0;	426	i = 0;
427	table[i++].prefix = prefix++;	427	prefix = 0;
428	for (; table[i].rangeLen != jbig2HuffmanEOT; ++i) {	428	table[i++].prefix = prefix++;
429	prefix <<= table[i].prefixLen - table[i-1].prefixLen;	429	for (; table[i].rangeLen != jbig2HuffmanEOT; ++i) {
430	table[i].prefix = prefix++;	430	prefix <<= table[i].prefixLen - table[i-1].prefixLen;
		431	table[i].prefix = prefix++;
		432	}
431	}	433	}
432	}	434	}
433		435
Lines 491-497 int JBIG2MMRDecoder::get2DCode() { Link Here
491	}	493	}
492	if (p->bits < 0) {	494	if (p->bits < 0) {
493	error(str->getPos(), "Bad two dim code in JBIG2 MMR stream");	495	error(str->getPos(), "Bad two dim code in JBIG2 MMR stream");
494	return 0;	496	return EOF;
495	}	497	}
496	bufLen -= p->bits;	498	bufLen -= p->bits;
497	return p->n;	499	return p->n;
Lines 684-691 JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, int wA, int hA): Link Here
684	h = hA;	686	h = hA;
685	line = (wA + 7) >> 3;	687	line = (wA + 7) >> 3;
686	if (w <= 0 \|\| h <= 0 \|\| line <= 0 \|\| h >= (INT_MAX - 1) / line) {	688	if (w <= 0 \|\| h <= 0 \|\| line <= 0 \|\| h >= (INT_MAX - 1) / line) {
687	data = NULL;	689	// force a call to gmalloc(-1), which will throw an exception
688	return;	690	h = -1;
		691	line = 2;
689	}	692	}
690	// need to allocate one extra guard byte for use in combine()	693	// need to allocate one extra guard byte for use in combine()
691	data = (Guchar )gmalloc(h line + 1);	694	data = (Guchar )gmalloc(h line + 1);
Lines 699-706 JBIG2Bitmap::JBIG2Bitmap(Guint segNumA, JBIG2Bitmap *bitmap): Link Here
699	h = bitmap->h;	702	h = bitmap->h;
700	line = bitmap->line;	703	line = bitmap->line;
701	if (w <= 0 \|\| h <= 0 \|\| line <= 0 \|\| h >= (INT_MAX - 1) / line) {	704	if (w <= 0 \|\| h <= 0 \|\| line <= 0 \|\| h >= (INT_MAX - 1) / line) {
702	data = NULL;	705	// force a call to gmalloc(-1), which will throw an exception
703	return;	706	h = -1;
		707	line = 2;
704	}	708	}
705	// need to allocate one extra guard byte for use in combine()	709	// need to allocate one extra guard byte for use in combine()
706	data = (Guchar )gmalloc(h line + 1);	710	data = (Guchar )gmalloc(h line + 1);
Lines 755-760 void JBIG2Bitmap::clearToOne() { Link Here
755	inline void JBIG2Bitmap::getPixelPtr(int x, int y, JBIG2BitmapPtr *ptr) {	759	inline void JBIG2Bitmap::getPixelPtr(int x, int y, JBIG2BitmapPtr *ptr) {
756	if (y < 0 \|\| y >= h \|\| x >= w) {	760	if (y < 0 \|\| y >= h \|\| x >= w) {
757	ptr->p = NULL;	761	ptr->p = NULL;
		762	ptr->shift = 0; // make gcc happy
		763	ptr->x = 0; // make gcc happy
758	} else if (x < 0) {	764	} else if (x < 0) {
759	ptr->p = &data[y * line];	765	ptr->p = &data[y * line];
760	ptr->shift = 7;	766	ptr->shift = 7;
Lines 799-804 void JBIG2Bitmap::combine(JBIG2Bitmap *bitmap, int x, int y, Link Here
799	Guint src0, src1, src, dest, s1, s2, m1, m2, m3;	805	Guint src0, src1, src, dest, s1, s2, m1, m2, m3;
800	GBool oneByte;	806	GBool oneByte;
801		807
		808	// check for the pathological case where y = -2^31
		809	if (y < -0x7fffffff) {
		810	return;
		811	}
802	if (y < 0) {	812	if (y < 0) {
803	y0 = -y;	813	y0 = -y;
804	} else {	814	} else {
Lines 1012-1019 private: Link Here
1012	JBIG2SymbolDict::JBIG2SymbolDict(Guint segNumA, Guint sizeA):	1022	JBIG2SymbolDict::JBIG2SymbolDict(Guint segNumA, Guint sizeA):
1013	JBIG2Segment(segNumA)	1023	JBIG2Segment(segNumA)
1014	{	1024	{
		1025	Guint i;
		1026
1015	size = sizeA;	1027	size = sizeA;
1016	bitmaps = (JBIG2Bitmap *)gmallocn(size, sizeof(JBIG2Bitmap ));	1028	bitmaps = (JBIG2Bitmap *)gmallocn(size, sizeof(JBIG2Bitmap ));
		1029	for (i = 0; i < size; ++i) {
		1030	bitmaps[i] = NULL;
		1031	}
1017	genericRegionStats = NULL;	1032	genericRegionStats = NULL;
1018	refinementRegionStats = NULL;	1033	refinementRegionStats = NULL;
1019	}	1034	}
Lines 1022-1028 JBIG2SymbolDict::~JBIG2SymbolDict() { Link Here
1022	Guint i;	1037	Guint i;
1023		1038
1024	for (i = 0; i < size; ++i) {	1039	for (i = 0; i < size; ++i) {
1025	delete bitmaps[i];	1040	if (bitmaps[i]) {
		1041	delete bitmaps[i];
		1042	}
1026	}	1043	}
1027	gfree(bitmaps);	1044	gfree(bitmaps);
1028	if (genericRegionStats) {	1045	if (genericRegionStats) {
Lines 1301-1306 void JBIG2Stream::readSegments() { Link Here
1301	// keep track of the start of the segment data	1318	// keep track of the start of the segment data
1302	segDataPos = getPos();	1319	segDataPos = getPos();
1303		1320
		1321	// check for missing page information segment
		1322	if (!pageBitmap && ((segType >= 4 && segType <= 7) \|\|
		1323	(segType >= 20 && segType <= 43))) {
		1324	error(getPos(), "First JBIG2 segment associated with a page must be a page information segment");
		1325	goto syntaxError;
		1326	}
		1327
1304	// read the segment data	1328	// read the segment data
1305	switch (segType) {	1329	switch (segType) {
1306	case 0:	1330	case 0:
Lines 1455-1460 GBool JBIG2Stream::readSymbolDictSeg(Guint segNum, Guint /length/, Link Here
1455	Guint i, j, k;	1479	Guint i, j, k;
1456	Guchar *p;	1480	Guchar *p;
1457		1481
		1482	symWidths = NULL;
		1483
1458	// symbol dictionary flags	1484	// symbol dictionary flags
1459	if (!readUWord(&flags)) {	1485	if (!readUWord(&flags)) {
1460	goto eofError;	1486	goto eofError;
Lines 1510-1535 GBool JBIG2Stream::readSymbolDictSeg(Guint segNum, Guint /length/, Link Here
1510	codeTables = new GList();	1536	codeTables = new GList();
1511	numInputSyms = 0;	1537	numInputSyms = 0;
1512	for (i = 0; i < nRefSegs; ++i) {	1538	for (i = 0; i < nRefSegs; ++i) {
1513	// This is need by poppler bug 12014, returning gFalse makes it not crash
1514	// but we end up with a empty page while acroread is able to render
1515	// part of it
1516	if ((seg = findSegment(refSegs[i]))) {	1539	if ((seg = findSegment(refSegs[i]))) {
1517	if (seg->getType() == jbig2SegSymbolDict) {	1540	if (seg->getType() == jbig2SegSymbolDict) {
1518	numInputSyms += ((JBIG2SymbolDict *)seg)->getSize();	1541	j = ((JBIG2SymbolDict *)seg)->getSize();
		1542	if (numInputSyms > UINT_MAX - j) {
		1543	error(getPos(), "Too many input symbols in JBIG2 symbol dictionary");
		1544	delete codeTables;
		1545	goto eofError;
		1546	}
		1547	numInputSyms += j;
1519	} else if (seg->getType() == jbig2SegCodeTable) {	1548	} else if (seg->getType() == jbig2SegCodeTable) {
1520	codeTables->append(seg);	1549	codeTables->append(seg);
1521	}	1550	}
1522	} else {
1523	return gFalse;
1524	}	1551	}
1525	}	1552	}
		1553	if (numInputSyms > UINT_MAX - numNewSyms) {
		1554	error(getPos(), "Too many input symbols in JBIG2 symbol dictionary");
		1555	delete codeTables;
		1556	goto eofError;
		1557	}
1526		1558
1527	// compute symbol code length	1559	// compute symbol code length
1528	symCodeLen = 0;	1560	symCodeLen = 1;
1529	i = 1;	1561	i = (numInputSyms + numNewSyms) >> 1;
1530	while (i < numInputSyms + numNewSyms) {	1562	while (i) {
1531	++symCodeLen;	1563	++symCodeLen;
1532	i <<= 1;	1564	i >>= 1;
1533	}	1565	}
1534		1566
1535	// get the input symbol bitmaps	1567	// get the input symbol bitmaps
Lines 1541-1551 GBool JBIG2Stream::readSymbolDictSeg(Guint segNum, Guint /length/, Link Here
1541	k = 0;	1573	k = 0;
1542	inputSymbolDict = NULL;	1574	inputSymbolDict = NULL;
1543	for (i = 0; i < nRefSegs; ++i) {	1575	for (i = 0; i < nRefSegs; ++i) {
1544	seg = findSegment(refSegs[i]);	1576	if ((seg = findSegment(refSegs[i]))) {
1545	if (seg->getType() == jbig2SegSymbolDict) {	1577	if (seg->getType() == jbig2SegSymbolDict) {
1546	inputSymbolDict = (JBIG2SymbolDict *)seg;	1578	inputSymbolDict = (JBIG2SymbolDict *)seg;
1547	for (j = 0; j < inputSymbolDict->getSize(); ++j) {	1579	for (j = 0; j < inputSymbolDict->getSize(); ++j) {
1548	bitmaps[k++] = inputSymbolDict->getBitmap(j);	1580	bitmaps[k++] = inputSymbolDict->getBitmap(j);
		1581	}
1549	}	1582	}
1550	}	1583	}
1551	}	1584	}
Lines 1560-1565 GBool JBIG2Stream::readSymbolDictSeg(Guint segNum, Guint /length/, Link Here
1560	} else if (huffDH == 1) {	1593	} else if (huffDH == 1) {
1561	huffDHTable = huffTableE;	1594	huffDHTable = huffTableE;
1562	} else {	1595	} else {
		1596	if (i >= (Guint)codeTables->getLength()) {
		1597	goto codeTableError;
		1598	}
1563	huffDHTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();	1599	huffDHTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
1564	}	1600	}
1565	if (huffDW == 0) {	1601	if (huffDW == 0) {
Lines 1567-1583 GBool JBIG2Stream::readSymbolDictSeg(Guint segNum, Guint /length/, Link Here
1567	} else if (huffDW == 1) {	1603	} else if (huffDW == 1) {
1568	huffDWTable = huffTableC;	1604	huffDWTable = huffTableC;
1569	} else {	1605	} else {
		1606	if (i >= (Guint)codeTables->getLength()) {
		1607	goto codeTableError;
		1608	}
1570	huffDWTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();	1609	huffDWTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
1571	}	1610	}
1572	if (huffBMSize == 0) {	1611	if (huffBMSize == 0) {
1573	huffBMSizeTable = huffTableA;	1612	huffBMSizeTable = huffTableA;
1574	} else {	1613	} else {
		1614	if (i >= (Guint)codeTables->getLength()) {
		1615	goto codeTableError;
		1616	}
1575	huffBMSizeTable =	1617	huffBMSizeTable =
1576	((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();	1618	((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
1577	}	1619	}
1578	if (huffAggInst == 0) {	1620	if (huffAggInst == 0) {
1579	huffAggInstTable = huffTableA;	1621	huffAggInstTable = huffTableA;
1580	} else {	1622	} else {
		1623	if (i >= (Guint)codeTables->getLength()) {
		1624	goto codeTableError;
		1625	}
1581	huffAggInstTable =	1626	huffAggInstTable =
1582	((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();	1627	((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
1583	}	1628	}
Lines 1610-1616 GBool JBIG2Stream::readSymbolDictSeg(Guint segNum, Guint /length/, Link Here
1610	}	1655	}
1611		1656
1612	// allocate symbol widths storage	1657	// allocate symbol widths storage
1613	symWidths = NULL;
1614	if (huff && !refAgg) {	1658	if (huff && !refAgg) {
1615	symWidths = (Guint *)gmallocn(numNewSyms, sizeof(Guint));	1659	symWidths = (Guint *)gmallocn(numNewSyms, sizeof(Guint));
1616	}	1660	}
Lines 1652-1657 GBool JBIG2Stream::readSymbolDictSeg(Guint segNum, Guint /length/, Link Here
1652	goto syntaxError;	1696	goto syntaxError;
1653	}	1697	}
1654	symWidth += dw;	1698	symWidth += dw;
		1699	if (i >= numNewSyms) {
		1700	error(getPos(), "Too many symbols in JBIG2 symbol dictionary");
		1701	goto syntaxError;
		1702	}
1655		1703
1656	// using a collective bitmap, so don't read a bitmap here	1704	// using a collective bitmap, so don't read a bitmap here
1657	if (huff && !refAgg) {	1705	if (huff && !refAgg) {
Lines 1688-1693 GBool JBIG2Stream::readSymbolDictSeg(Guint segNum, Guint /length/, Link Here
1688	arithDecoder->decodeInt(&refDX, iardxStats);	1736	arithDecoder->decodeInt(&refDX, iardxStats);
1689	arithDecoder->decodeInt(&refDY, iardyStats);	1737	arithDecoder->decodeInt(&refDY, iardyStats);
1690	}	1738	}
		1739	if (symID >= numInputSyms + i) {
		1740	error(getPos(), "Invalid symbol ID in JBIG2 symbol dictionary");
		1741	goto syntaxError;
		1742	}
1691	refBitmap = bitmaps[symID];	1743	refBitmap = bitmaps[symID];
1692	bitmaps[numInputSyms + i] =	1744	bitmaps[numInputSyms + i] =
1693	readGenericRefinementRegion(symWidth, symHeight,	1745	readGenericRefinementRegion(symWidth, symHeight,
Lines 1754-1759 GBool JBIG2Stream::readSymbolDictSeg(Guint segNum, Guint /length/, Link Here
1754	} else {	1806	} else {
1755	arithDecoder->decodeInt(&run, iaexStats);	1807	arithDecoder->decodeInt(&run, iaexStats);
1756	}	1808	}
		1809	if (i + run > numInputSyms + numNewSyms \|\|
		1810	(ex && j + run > numExSyms)) {
		1811	error(getPos(), "Too many exported symbols in JBIG2 symbol dictionary");
		1812	delete symbolDict;
		1813	goto syntaxError;
		1814	}
1757	if (ex) {	1815	if (ex) {
1758	for (cnt = 0; cnt < run; ++cnt) {	1816	for (cnt = 0; cnt < run; ++cnt) {
1759	symbolDict->setBitmap(j++, bitmaps[i++]->copy());	1817	symbolDict->setBitmap(j++, bitmaps[i++]->copy());
Lines 1763-1768 GBool JBIG2Stream::readSymbolDictSeg(Guint segNum, Guint /length/, Link Here
1763	}	1821	}
1764	ex = !ex;	1822	ex = !ex;
1765	}	1823	}
		1824	if (j != numExSyms) {
		1825	error(getPos(), "Too few symbols in JBIG2 symbol dictionary");
		1826	delete symbolDict;
		1827	goto syntaxError;
		1828	}
1766		1829
1767	for (i = 0; i < numNewSyms; ++i) {	1830	for (i = 0; i < numNewSyms; ++i) {
1768	delete bitmaps[numInputSyms + i];	1831	delete bitmaps[numInputSyms + i];
Lines 1785-1790 GBool JBIG2Stream::readSymbolDictSeg(Guint segNum, Guint /length/, Link Here
1785		1848
1786	return gTrue;	1849	return gTrue;
1787		1850
		1851	codeTableError:
		1852	error(getPos(), "Missing code table in JBIG2 symbol dictionary");
		1853	delete codeTables;
		1854
1788	syntaxError:	1855	syntaxError:
1789	for (i = 0; i < numNewSyms; ++i) {	1856	for (i = 0; i < numNewSyms; ++i) {
1790	if (bitmaps[numInputSyms + i]) {	1857	if (bitmaps[numInputSyms + i]) {
Lines 1887-1892 void JBIG2Stream::readTextRegionSeg(Guint segNum, GBool imm, Link Here
1887	}	1954	}
1888	} else {	1955	} else {
1889	error(getPos(), "Invalid segment reference in JBIG2 text region");	1956	error(getPos(), "Invalid segment reference in JBIG2 text region");
		1957	delete codeTables;
		1958	return;
1890	}	1959	}
1891	}	1960	}
1892	symCodeLen = 0;	1961	symCodeLen = 0;
Lines 1921-1926 void JBIG2Stream::readTextRegionSeg(Guint segNum, GBool imm, Link Here
1921	} else if (huffFS == 1) {	1990	} else if (huffFS == 1) {
1922	huffFSTable = huffTableG;	1991	huffFSTable = huffTableG;
1923	} else {	1992	} else {
		1993	if (i >= (Guint)codeTables->getLength()) {
		1994	goto codeTableError;
		1995	}
1924	huffFSTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();	1996	huffFSTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
1925	}	1997	}
1926	if (huffDS == 0) {	1998	if (huffDS == 0) {
Lines 1930-1935 void JBIG2Stream::readTextRegionSeg(Guint segNum, GBool imm, Link Here
1930	} else if (huffDS == 2) {	2002	} else if (huffDS == 2) {
1931	huffDSTable = huffTableJ;	2003	huffDSTable = huffTableJ;
1932	} else {	2004	} else {
		2005	if (i >= (Guint)codeTables->getLength()) {
		2006	goto codeTableError;
		2007	}
1933	huffDSTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();	2008	huffDSTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
1934	}	2009	}
1935	if (huffDT == 0) {	2010	if (huffDT == 0) {
Lines 1939-1944 void JBIG2Stream::readTextRegionSeg(Guint segNum, GBool imm, Link Here
1939	} else if (huffDT == 2) {	2014	} else if (huffDT == 2) {
1940	huffDTTable = huffTableM;	2015	huffDTTable = huffTableM;
1941	} else {	2016	} else {
		2017	if (i >= (Guint)codeTables->getLength()) {
		2018	goto codeTableError;
		2019	}
1942	huffDTTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();	2020	huffDTTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
1943	}	2021	}
1944	if (huffRDW == 0) {	2022	if (huffRDW == 0) {
Lines 1946-1951 void JBIG2Stream::readTextRegionSeg(Guint segNum, GBool imm, Link Here
1946	} else if (huffRDW == 1) {	2024	} else if (huffRDW == 1) {
1947	huffRDWTable = huffTableO;	2025	huffRDWTable = huffTableO;
1948	} else {	2026	} else {
		2027	if (i >= (Guint)codeTables->getLength()) {
		2028	goto codeTableError;
		2029	}
1949	huffRDWTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();	2030	huffRDWTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
1950	}	2031	}
1951	if (huffRDH == 0) {	2032	if (huffRDH == 0) {
Lines 1953-1958 void JBIG2Stream::readTextRegionSeg(Guint segNum, GBool imm, Link Here
1953	} else if (huffRDH == 1) {	2034	} else if (huffRDH == 1) {
1954	huffRDHTable = huffTableO;	2035	huffRDHTable = huffTableO;
1955	} else {	2036	} else {
		2037	if (i >= (Guint)codeTables->getLength()) {
		2038	goto codeTableError;
		2039	}
1956	huffRDHTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();	2040	huffRDHTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
1957	}	2041	}
1958	if (huffRDX == 0) {	2042	if (huffRDX == 0) {
Lines 1960-1965 void JBIG2Stream::readTextRegionSeg(Guint segNum, GBool imm, Link Here
1960	} else if (huffRDX == 1) {	2044	} else if (huffRDX == 1) {
1961	huffRDXTable = huffTableO;	2045	huffRDXTable = huffTableO;
1962	} else {	2046	} else {
		2047	if (i >= (Guint)codeTables->getLength()) {
		2048	goto codeTableError;
		2049	}
1963	huffRDXTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();	2050	huffRDXTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
1964	}	2051	}
1965	if (huffRDY == 0) {	2052	if (huffRDY == 0) {
Lines 1967-1977 void JBIG2Stream::readTextRegionSeg(Guint segNum, GBool imm, Link Here
1967	} else if (huffRDY == 1) {	2054	} else if (huffRDY == 1) {
1968	huffRDYTable = huffTableO;	2055	huffRDYTable = huffTableO;
1969	} else {	2056	} else {
		2057	if (i >= (Guint)codeTables->getLength()) {
		2058	goto codeTableError;
		2059	}
1970	huffRDYTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();	2060	huffRDYTable = ((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
1971	}	2061	}
1972	if (huffRSize == 0) {	2062	if (huffRSize == 0) {
1973	huffRSizeTable = huffTableA;	2063	huffRSizeTable = huffTableA;
1974	} else {	2064	} else {
		2065	if (i >= (Guint)codeTables->getLength()) {
		2066	goto codeTableError;
		2067	}
1975	huffRSizeTable =	2068	huffRSizeTable =
1976	((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();	2069	((JBIG2CodeTable *)codeTables->get(i++))->getHuffTable();
1977	}	2070	}
Lines 2066-2073 void JBIG2Stream::readTextRegionSeg(Guint segNum, GBool imm, Link Here
2066		2159
2067	return;	2160	return;
2068		2161
		2162	codeTableError:
		2163	error(getPos(), "Missing code table in JBIG2 text region");
		2164	gfree(codeTables);
		2165	delete syms;
		2166	return;
		2167
2069	eofError:	2168	eofError:
2070	error(getPos(), "Unexpected EOF in JBIG2 stream");	2169	error(getPos(), "Unexpected EOF in JBIG2 stream");
		2170	return;
2071	}	2171	}
2072		2172
2073	JBIG2Bitmap *JBIG2Stream::readTextRegion(GBool huff, GBool refine,	2173	JBIG2Bitmap *JBIG2Stream::readTextRegion(GBool huff, GBool refine,
Lines 2374-2381 void JBIG2Stream::readHalftoneRegionSeg(Guint segNum, GBool imm, Link Here
2374	error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");	2474	error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");
2375	return;	2475	return;
2376	}	2476	}
2377	seg = findSegment(refSegs[0]);	2477	if (!(seg = findSegment(refSegs[0])) \|\|
2378	if (seg->getType() != jbig2SegPatternDict) {	2478	seg->getType() != jbig2SegPatternDict) {
2379	error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");	2479	error(getPos(), "Bad symbol dictionary reference in JBIG2 halftone segment");
2380	return;	2480	return;
2381	}	2481	}
Lines 2533-2539 void JBIG2Stream::readGenericRegionSeg(Guint segNum, GBool imm, Link Here
2533		2633
2534	// read the bitmap	2634	// read the bitmap
2535	bitmap = readGenericBitmap(mmr, w, h, templ, tpgdOn, gFalse,	2635	bitmap = readGenericBitmap(mmr, w, h, templ, tpgdOn, gFalse,
2536	NULL, atx, aty, mmr ? 0 : length - 18);	2636	NULL, atx, aty, mmr ? length - 18 : 0);
2537		2637
2538	// combine the region bitmap into the page bitmap	2638	// combine the region bitmap into the page bitmap
2539	if (imm) {	2639	if (imm) {
Lines 2555-2560 void JBIG2Stream::readGenericRegionSeg(Guint segNum, GBool imm, Link Here
2555	error(getPos(), "Unexpected EOF in JBIG2 stream");	2655	error(getPos(), "Unexpected EOF in JBIG2 stream");
2556	}	2656	}
2557		2657
		2658	inline void JBIG2Stream::mmrAddPixels(int a1, int blackPixels,
		2659	int codingLine, int a0i, int w) {
		2660	if (a1 > codingLine[*a0i]) {
		2661	if (a1 > w) {
		2662	error(getPos(), "JBIG2 MMR row is wrong length ({0:d})", a1);
		2663	a1 = w;
		2664	}
		2665	if ((*a0i & 1) ^ blackPixels) {
		2666	++*a0i;
		2667	}
		2668	codingLine[*a0i] = a1;
		2669	}
		2670	}
		2671
		2672	inline void JBIG2Stream::mmrAddPixelsNeg(int a1, int blackPixels,
		2673	int codingLine, int a0i, int w) {
		2674	if (a1 > codingLine[*a0i]) {
		2675	if (a1 > w) {
		2676	error(getPos(), "JBIG2 MMR row is wrong length ({0:d})", a1);
		2677	a1 = w;
		2678	}
		2679	if ((*a0i & 1) ^ blackPixels) {
		2680	++*a0i;
		2681	}
		2682	codingLine[*a0i] = a1;
		2683	} else if (a1 < codingLine[*a0i]) {
		2684	if (a1 < 0) {
		2685	error(getPos(), "Invalid JBIG2 MMR code");
		2686	a1 = 0;
		2687	}
		2688	while (a0i > 0 && a1 <= codingLine[a0i - 1]) {
		2689	--*a0i;
		2690	}
		2691	codingLine[*a0i] = a1;
		2692	}
		2693	}
		2694
2558	JBIG2Bitmap *JBIG2Stream::readGenericBitmap(GBool mmr, int w, int h,	2695	JBIG2Bitmap *JBIG2Stream::readGenericBitmap(GBool mmr, int w, int h,
2559	int templ, GBool tpgdOn,	2696	int templ, GBool tpgdOn,
2560	GBool useSkip, JBIG2Bitmap *skip,	2697	GBool useSkip, JBIG2Bitmap *skip,
Lines 2567-2573 JBIG2Bitmap *JBIG2Stream::readGenericBitmap(GBool mmr, int w, int h, Link Here
2567	JBIG2BitmapPtr atPtr0, atPtr1, atPtr2, atPtr3;	2704	JBIG2BitmapPtr atPtr0, atPtr1, atPtr2, atPtr3;
2568	int refLine, codingLine;	2705	int refLine, codingLine;
2569	int code1, code2, code3;	2706	int code1, code2, code3;
2570	int x, y, a0, pix, i, refI, codingI;	2707	int x, y, a0i, b1i, blackPixels, pix, i;
2571		2708
2572	bitmap = new JBIG2Bitmap(0, w, h);	2709	bitmap = new JBIG2Bitmap(0, w, h);
2573	bitmap->clearToZero();	2710	bitmap->clearToZero();
Lines 2577-2585 JBIG2Bitmap *JBIG2Stream::readGenericBitmap(GBool mmr, int w, int h, Link Here
2577	if (mmr) {	2714	if (mmr) {
2578		2715
2579	mmrDecoder->reset();	2716	mmrDecoder->reset();
		2717	if (w > INT_MAX - 2) {
		2718	error(getPos(), "Bad width in JBIG2 generic bitmap");
		2719	// force a call to gmalloc(-1), which will throw an exception
		2720	w = -3;
		2721	}
		2722	// 0 <= codingLine[0] < codingLine[1] < ... < codingLine[n] = w
		2723	// ---> max codingLine size = w + 1
		2724	// refLine has one extra guard entry at the end
		2725	// ---> max refLine size = w + 2
		2726	codingLine = (int *)gmallocn(w + 1, sizeof(int));
2580	refLine = (int *)gmallocn(w + 2, sizeof(int));	2727	refLine = (int *)gmallocn(w + 2, sizeof(int));
2581	codingLine = (int *)gmallocn(w + 2, sizeof(int));	2728	codingLine[0] = w;
2582	codingLine[0] = codingLine[1] = w;
2583		2729
2584	for (y = 0; y < h; ++y) {	2730	for (y = 0; y < h; ++y) {
2585		2731
Lines 2587-2714 JBIG2Bitmap *JBIG2Stream::readGenericBitmap(GBool mmr, int w, int h, Link Here
2587	for (i = 0; codingLine[i] < w; ++i) {	2733	for (i = 0; codingLine[i] < w; ++i) {
2588	refLine[i] = codingLine[i];	2734	refLine[i] = codingLine[i];
2589	}	2735	}
2590	refLine[i] = refLine[i + 1] = w;	2736	refLine[i++] = w;
		2737	refLine[i] = w;
2591		2738
2592	// decode a line	2739	// decode a line
2593	refI = 0; // b1 = refLine[refI]	2740	codingLine[0] = 0;
2594	codingI = 0; // a1 = codingLine[codingI]	2741	a0i = 0;
2595	a0 = 0;	2742	b1i = 0;
2596	do {	2743	blackPixels = 0;
		2744	// invariant:
		2745	// refLine[b1i-1] <= codingLine[a0i] < refLine[b1i] < refLine[b1i+1] <= w
		2746	// exception at left edge:
		2747	// codingLine[a0i = 0] = refLine[b1i = 0] = 0 is possible
		2748	// exception at right edge:
		2749	// refLine[b1i] = refLine[b1i+1] = w is possible
		2750	while (codingLine[a0i] < w) {
2597	code1 = mmrDecoder->get2DCode();	2751	code1 = mmrDecoder->get2DCode();
2598	switch (code1) {	2752	switch (code1) {
2599	case twoDimPass:	2753	case twoDimPass:
2600	if (refLine[refI] < w) {	2754	mmrAddPixels(refLine[b1i + 1], blackPixels, codingLine, &a0i, w);
2601	a0 = refLine[refI + 1];	2755	if (refLine[b1i + 1] < w) {
2602	refI += 2;	2756	b1i += 2;
2603	}	2757	}
2604	break;	2758	break;
2605	case twoDimHoriz:	2759	case twoDimHoriz:
2606	if (codingI & 1) {	2760	code1 = code2 = 0;
2607	code1 = 0;	2761	if (blackPixels) {
2608	do {	2762	do {
2609	code1 += code3 = mmrDecoder->getBlackCode();	2763	code1 += code3 = mmrDecoder->getBlackCode();
2610	} while (code3 >= 64);	2764	} while (code3 >= 64);
2611	code2 = 0;	2765	do {
2612	do {	2766	code2 += code3 = mmrDecoder->getWhiteCode();
2613	code2 += code3 = mmrDecoder->getWhiteCode();	2767	} while (code3 >= 64);
2614	} while (code3 >= 64);	2768	} else {
2615	} else {	2769	do {
2616	code1 = 0;	2770	code1 += code3 = mmrDecoder->getWhiteCode();
2617	do {	2771	} while (code3 >= 64);
2618	code1 += code3 = mmrDecoder->getWhiteCode();	2772	do {
2619	} while (code3 >= 64);	2773	code2 += code3 = mmrDecoder->getBlackCode();
2620	code2 = 0;	2774	} while (code3 >= 64);
2621	do {	2775	}
2622	code2 += code3 = mmrDecoder->getBlackCode();	2776	mmrAddPixels(codingLine[a0i] + code1, blackPixels,
2623	} while (code3 >= 64);	2777	codingLine, &a0i, w);
2624	}	2778	if (codingLine[a0i] < w) {
2625	if (code1 > 0 \|\| code2 > 0) {	2779	mmrAddPixels(codingLine[a0i] + code2, blackPixels ^ 1,
2626	a0 = codingLine[codingI++] = a0 + code1;	2780	codingLine, &a0i, w);
2627	a0 = codingLine[codingI++] = a0 + code2;	2781	}
2628	while (refLine[refI] <= a0 && refLine[refI] < w) {	2782	while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) {
2629	refI += 2;	2783	b1i += 2;
2630	}	2784	}
2631	}	2785	break;
2632	break;
2633	case twoDimVert0:
2634	a0 = codingLine[codingI++] = refLine[refI];
2635	if (refLine[refI] < w) {
2636	++refI;
2637	}
2638	break;
2639	case twoDimVertR1:
2640	a0 = codingLine[codingI++] = refLine[refI] + 1;
2641	if (refLine[refI] < w) {
2642	++refI;
2643	while (refLine[refI] <= a0 && refLine[refI] < w) {
2644	refI += 2;
2645	}
2646	}
2647	break;
2648	case twoDimVertR2:
2649	a0 = codingLine[codingI++] = refLine[refI] + 2;
2650	if (refLine[refI] < w) {
2651	++refI;
2652	while (refLine[refI] <= a0 && refLine[refI] < w) {
2653	refI += 2;
2654	}
2655	}
2656	break;
2657	case twoDimVertR3:	2786	case twoDimVertR3:
2658	a0 = codingLine[codingI++] = refLine[refI] + 3;	2787	mmrAddPixels(refLine[b1i] + 3, blackPixels, codingLine, &a0i, w);
2659	if (refLine[refI] < w) {	2788	blackPixels ^= 1;
2660	++refI;	2789	if (codingLine[a0i] < w) {
2661	while (refLine[refI] <= a0 && refLine[refI] < w) {	2790	++b1i;
2662	refI += 2;	2791	while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) {
2663	}	2792	b1i += 2;
2664	}	2793	}
2665	break;	2794	}
2666	case twoDimVertL1:	2795	break;
2667	a0 = codingLine[codingI++] = refLine[refI] - 1;	2796	case twoDimVertR2:
2668	if (refI > 0) {	2797	mmrAddPixels(refLine[b1i] + 2, blackPixels, codingLine, &a0i, w);
2669	--refI;	2798	blackPixels ^= 1;
2670	} else {	2799	if (codingLine[a0i] < w) {
2671	++refI;	2800	++b1i;
2672	}	2801	while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) {
2673	while (refLine[refI] <= a0 && refLine[refI] < w) {	2802	b1i += 2;
2674	refI += 2;	2803	}
2675	}	2804	}
2676	break;	2805	break;
2677	case twoDimVertL2:	2806	case twoDimVertR1:
2678	a0 = codingLine[codingI++] = refLine[refI] - 2;	2807	mmrAddPixels(refLine[b1i] + 1, blackPixels, codingLine, &a0i, w);
2679	if (refI > 0) {	2808	blackPixels ^= 1;
2680	--refI;	2809	if (codingLine[a0i] < w) {
2681	} else {	2810	++b1i;
2682	++refI;	2811	while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) {
2683	}	2812	b1i += 2;
2684	while (refLine[refI] <= a0 && refLine[refI] < w) {	2813	}
2685	refI += 2;	2814	}
2686	}	2815	break;
2687	break;	2816	case twoDimVert0:
		2817	mmrAddPixels(refLine[b1i], blackPixels, codingLine, &a0i, w);
		2818	blackPixels ^= 1;
		2819	if (codingLine[a0i] < w) {
		2820	++b1i;
		2821	while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) {
		2822	b1i += 2;
		2823	}
		2824	}
		2825	break;
2688	case twoDimVertL3:	2826	case twoDimVertL3:
2689	a0 = codingLine[codingI++] = refLine[refI] - 3;	2827	mmrAddPixelsNeg(refLine[b1i] - 3, blackPixels, codingLine, &a0i, w);
2690	if (refI > 0) {	2828	blackPixels ^= 1;
2691	--refI;	2829	if (codingLine[a0i] < w) {
2692	} else {	2830	if (b1i > 0) {
2693	++refI;	2831	--b1i;
2694	}	2832	} else {
2695	while (refLine[refI] <= a0 && refLine[refI] < w) {	2833	++b1i;
2696	refI += 2;	2834	}
2697	}	2835	while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) {
2698	break;	2836	b1i += 2;
		2837	}
		2838	}
		2839	break;
		2840	case twoDimVertL2:
		2841	mmrAddPixelsNeg(refLine[b1i] - 2, blackPixels, codingLine, &a0i, w);
		2842	blackPixels ^= 1;
		2843	if (codingLine[a0i] < w) {
		2844	if (b1i > 0) {
		2845	--b1i;
		2846	} else {
		2847	++b1i;
		2848	}
		2849	while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) {
		2850	b1i += 2;
		2851	}
		2852	}
		2853	break;
		2854	case twoDimVertL1:
		2855	mmrAddPixelsNeg(refLine[b1i] - 1, blackPixels, codingLine, &a0i, w);
		2856	blackPixels ^= 1;
		2857	if (codingLine[a0i] < w) {
		2858	if (b1i > 0) {
		2859	--b1i;
		2860	} else {
		2861	++b1i;
		2862	}
		2863	while (refLine[b1i] <= codingLine[a0i] && refLine[b1i] < w) {
		2864	b1i += 2;
		2865	}
		2866	}
		2867	break;
		2868	case EOF:
		2869	mmrAddPixels(w, 0, codingLine, &a0i, w);
		2870	break;
2699	default:	2871	default:
2700	error(getPos(), "Illegal code in JBIG2 MMR bitmap data");	2872	error(getPos(), "Illegal code in JBIG2 MMR bitmap data");
		2873	mmrAddPixels(w, 0, codingLine, &a0i, w);
2701	break;	2874	break;
2702	}	2875	}
2703	} while (a0 < w);	2876	}
2704	codingLine[codingI++] = w;
2705		2877
2706	// convert the run lengths to a bitmap line	2878	// convert the run lengths to a bitmap line
2707	i = 0;	2879	i = 0;
2708	while (codingLine[i] < w) {	2880	while (1) {
2709	for (x = codingLine[i]; x < codingLine[i+1]; ++x) {	2881	for (x = codingLine[i]; x < codingLine[i+1]; ++x) {
2710	bitmap->setPixel(x, y);	2882	bitmap->setPixel(x, y);
2711	}	2883	}
		2884	if (codingLine[i+1] >= w \|\| codingLine[i+2] >= w) {
		2885	break;
		2886	}
2712	i += 2;	2887	i += 2;
2713	}	2888	}
2714	}	2889	}
Lines 2756-2762 JBIG2Bitmap *JBIG2Stream::readGenericBitmap(GBool mmr, int w, int h, Link Here
2756	ltp = !ltp;	2931	ltp = !ltp;
2757	}	2932	}
2758	if (ltp) {	2933	if (ltp) {
2759	bitmap->duplicateRow(y, y-1);	2934	if (y > 0) {
		2935	bitmap->duplicateRow(y, y-1);
		2936	}
2760	continue;	2937	continue;
2761	}	2938	}
2762	}	2939	}
Lines 2959-2966 void JBIG2Stream::readGenericRefinementRegionSeg(Guint segNum, GBool imm, Link Here
2959	return;	3136	return;
2960	}	3137	}
2961	if (nRefSegs == 1) {	3138	if (nRefSegs == 1) {
2962	seg = findSegment(refSegs[0]);	3139	if (!(seg = findSegment(refSegs[0])) \|\|
2963	if (seg->getType() != jbig2SegBitmap) {	3140	seg->getType() != jbig2SegBitmap) {
2964	error(getPos(), "Bad bitmap reference in JBIG2 generic refinement segment");	3141	error(getPos(), "Bad bitmap reference in JBIG2 generic refinement segment");
2965	return;	3142	return;
2966	}	3143	}
Lines 3054-3059 JBIG2Bitmap *JBIG2Stream::readGenericRefinementRegion(int w, int h, Link Here
3054	tpgrCX2 = refBitmap->nextPixel(&tpgrCXPtr2);	3231	tpgrCX2 = refBitmap->nextPixel(&tpgrCXPtr2);
3055	tpgrCX2 = (tpgrCX2 << 1) \| refBitmap->nextPixel(&tpgrCXPtr2);	3232	tpgrCX2 = (tpgrCX2 << 1) \| refBitmap->nextPixel(&tpgrCXPtr2);
3056	tpgrCX2 = (tpgrCX2 << 1) \| refBitmap->nextPixel(&tpgrCXPtr2);	3233	tpgrCX2 = (tpgrCX2 << 1) \| refBitmap->nextPixel(&tpgrCXPtr2);
		3234	} else {
		3235	tpgrCXPtr0.p = tpgrCXPtr1.p = tpgrCXPtr2.p = NULL; // make gcc happy
		3236	tpgrCXPtr0.shift = tpgrCXPtr1.shift = tpgrCXPtr2.shift = 0;
		3237	tpgrCXPtr0.x = tpgrCXPtr1.x = tpgrCXPtr2.x = 0;
3057	}	3238	}
3058		3239
3059	for (x = 0; x < w; ++x) {	3240	for (x = 0; x < w; ++x) {
Lines 3125-3130 JBIG2Bitmap *JBIG2Stream::readGenericRefinementRegion(int w, int h, Link Here
3125	tpgrCX2 = refBitmap->nextPixel(&tpgrCXPtr2);	3306	tpgrCX2 = refBitmap->nextPixel(&tpgrCXPtr2);
3126	tpgrCX2 = (tpgrCX2 << 1) \| refBitmap->nextPixel(&tpgrCXPtr2);	3307	tpgrCX2 = (tpgrCX2 << 1) \| refBitmap->nextPixel(&tpgrCXPtr2);
3127	tpgrCX2 = (tpgrCX2 << 1) \| refBitmap->nextPixel(&tpgrCXPtr2);	3308	tpgrCX2 = (tpgrCX2 << 1) \| refBitmap->nextPixel(&tpgrCXPtr2);
		3309	} else {
		3310	tpgrCXPtr0.p = tpgrCXPtr1.p = tpgrCXPtr2.p = NULL; // make gcc happy
		3311	tpgrCXPtr0.shift = tpgrCXPtr1.shift = tpgrCXPtr2.shift = 0;
		3312	tpgrCXPtr0.x = tpgrCXPtr1.x = tpgrCXPtr2.x = 0;
3128	}	3313	}
3129		3314
3130	for (x = 0; x < w; ++x) {	3315	for (x = 0; x < w; ++x) {

Lines 78-83 private: Link Here

(-)xpdf-3.02.orig/xpdf/JBIG2Stream.h (+4 lines)
78	Guint *refSegs, Guint nRefSegs);	78	Guint *refSegs, Guint nRefSegs);
79	void readGenericRegionSeg(Guint segNum, GBool imm,	79	void readGenericRegionSeg(Guint segNum, GBool imm,
80	GBool lossless, Guint length);	80	GBool lossless, Guint length);
		81	void mmrAddPixels(int a1, int blackPixels,
		82	int codingLine, int a0i, int w);
		83	void mmrAddPixelsNeg(int a1, int blackPixels,
		84	int codingLine, int a0i, int w);
81	JBIG2Bitmap *readGenericBitmap(GBool mmr, int w, int h,	85	JBIG2Bitmap *readGenericBitmap(GBool mmr, int w, int h,
82	int templ, GBool tpgdOn,	86	int templ, GBool tpgdOn,
83	GBool useSkip, JBIG2Bitmap *skip,	87	GBool useSkip, JBIG2Bitmap *skip,

Return to bug 264603