Attachment #88258 for bug #135385

Lines 437-442 Link Here

(-)TeX.orig/libs/xpdf/goo/gfile.cc (+2 lines)
437	#endif	437	#endif
438	}	438	}
439		439
		440	#ifndef PDF_PARSER_ONLY
440	GBool openTempFile(GString name, FILE f, char mode, char ext) {	441	GBool openTempFile(GString name, FILE f, char mode, char ext) {
441	#if defined(WIN32)	442	#if defined(WIN32)
442	//---------- Win32 ----------	443	//---------- Win32 ----------
Lines 521-526 Link Here
521	return gTrue;	522	return gTrue;
522	#endif	523	#endif
523	}	524	}
		525	#endif
524		526
525	GBool executeCommand(char *cmd) {	527	GBool executeCommand(char *cmd) {
526	#ifdef VMS	528	#ifdef VMS

Lines 46-51 Link Here

(-)TeX.orig/libs/xpdf/goo/gfile.h (+5 lines)
46	# endif	46	# endif
47	# endif	47	# endif
48	#endif	48	#endif
		49	#if defined(__DJGPP__)
		50	typedef unsigned int time_t;
		51	#endif
49	#include "gtypes.h"	52	#include "gtypes.h"
50		53
51	class GString;	54	class GString;
Lines 83-89 Link Here
83	// should be done to the returned file pointer; the file may be	86	// should be done to the returned file pointer; the file may be
84	// reopened later for reading, but not for writing. The <mode> string	87	// reopened later for reading, but not for writing. The <mode> string
85	// should be "w" or "wb". Returns true on success.	88	// should be "w" or "wb". Returns true on success.
		89	#ifndef PDF_PARSER_ONLY
86	extern GBool openTempFile(GString name, FILE f, char mode, char ext);	90	extern GBool openTempFile(GString name, FILE f, char mode, char ext);
		91	#endif
87		92
88	// Execute <command>. Returns true on success.	93	// Execute <command>. Returns true on success.
89	extern GBool executeCommand(char *cmd);	94	extern GBool executeCommand(char *cmd);




#include <stdlib.h>
#include <stddef.h>
#include <string.h>
#include <limits.h>
#include "gmem.h"

#ifdef DEBUG_MEM

  int lst;
  unsigned long *trl, *p;

  if (size <= 0)
    return NULL;
  size1 = gMemDataSize(size);
  if (!(mem = (char *)malloc(size1 + gMemHdrSize + gMemTrlSize))) {

#else
  void *p;

  if (size <= 0)
    return NULL;
  if (!(p = malloc(size))) {
    fprintf(stderr, "Out of memory\n");

  void *q;
  int oldSize;

  if (size <= 0) {
    if (p)
      gfree(p);
    return NULL;

#else
  void *q;

  if (size <= 0) {
    if (p)
      free(p);
    return NULL;

void *gmallocn(int nObjs, int objSize) {
  int n;

  if (nObjs == 0) {
    return NULL;
  }
  n = nObjs * objSize;
  if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
    fprintf(stderr, "Bogus memory allocation size\n");
    exit(1);
  }

void *greallocn(void *p, int nObjs, int objSize) {
  int n;

  if (nObjs == 0) {
    if (p) {
      gfree(p);
    }
    return NULL;
  }
  n = nObjs * objSize;
  if (objSize <= 0 || nObjs < 0 || nObjs >= INT_MAX / objSize) {
    fprintf(stderr, "Bogus memory allocation size\n");
    exit(1);
  }

Lines 4-9 Link Here

(-)TeX.orig/libs/xpdf/goo/Makefile.in (-1 / +5 lines)
4	#	4	#
5	# Copyright 1996 Derek B. Noonburg	5	# Copyright 1996 Derek B. Noonburg
6	#	6	#
		7	# Modified for pdftex by Martin Schröder 2005
		8	#
7	#========================================================================	9	#========================================================================
8		10
9	srcdir = @srcdir@	11	srcdir = @srcdir@
Lines 13-19 Link Here
13		15
14	kpathsea_include_dir = -I../../../texk -I$(srcdir)/../../../texk	16	kpathsea_include_dir = -I../../../texk -I$(srcdir)/../../../texk
15	ALLCFLAGS = $(CFLAGS) @DEFS@ -I.. -I$(srcdir)/.. -I. -I$(srcdir) $(kpathsea_include_dir)	17	ALLCFLAGS = $(CFLAGS) @DEFS@ -I.. -I$(srcdir)/.. -I. -I$(srcdir) $(kpathsea_include_dir)
16	ALLCXXFLAGS = $(CXXFLAGS) @DEFS@ -I.. -I$(srcdir)/.. -I. -I$(srcdir) $(kpathsea_include_dir)	18	ALLCXXFLAGS = $(CXXFLAGS) @DEFS@ \
		19	-I.. -I$(srcdir)/.. -I. -I$(srcdir) $(kpathsea_include_dir) \
		20	-DPDF_PARSER_ONLY
17	CXXFLAGS = @CXXFLAGS@	21	CXXFLAGS = @CXXFLAGS@
18	CC = @CC@	22	CC = @CC@
19	CXX = @CXX@	23	CXX = @CXX@

Lines 13-18 Link Here

(-)TeX.orig/libs/xpdf/xpdf/JBIG2Stream.cc (-1 / +18 lines)
13	#endif	13	#endif
14		14
15	#include <stdlib.h>	15	#include <stdlib.h>
		16	#include <limits.h>
16	#include "GList.h"	17	#include "GList.h"
17	#include "Error.h"	18	#include "Error.h"
18	#include "JArithmeticDecoder.h"	19	#include "JArithmeticDecoder.h"
Lines 681-686 Link Here
681	w = wA;	682	w = wA;
682	h = hA;	683	h = hA;
683	line = (wA + 7) >> 3;	684	line = (wA + 7) >> 3;
		685	if (w <= 0 \|\| h <= 0 \|\| line <= 0 \|\| h >= (INT_MAX - 1) / line) {
		686	data = NULL;
		687	return;
		688	}
684	// need to allocate one extra guard byte for use in combine()	689	// need to allocate one extra guard byte for use in combine()
685	data = (Guchar )gmalloc(h line + 1);	690	data = (Guchar )gmalloc(h line + 1);
686	data[h * line] = 0;	691	data[h * line] = 0;
Lines 692-697 Link Here
692	w = bitmap->w;	697	w = bitmap->w;
693	h = bitmap->h;	698	h = bitmap->h;
694	line = bitmap->line;	699	line = bitmap->line;
		700	if (w <= 0 \|\| h <= 0 \|\| line <= 0 \|\| h >= (INT_MAX - 1) / line) {
		701	data = NULL;
		702	return;
		703	}
695	// need to allocate one extra guard byte for use in combine()	704	// need to allocate one extra guard byte for use in combine()
696	data = (Guchar )gmalloc(h line + 1);	705	data = (Guchar )gmalloc(h line + 1);
697	memcpy(data, bitmap->data, h * line);	706	memcpy(data, bitmap->data, h * line);
Lines 720-726 Link Here
720	}	729	}
721		730
722	void JBIG2Bitmap::expand(int newH, Guint pixel) {	731	void JBIG2Bitmap::expand(int newH, Guint pixel) {
723	if (newH <= h) {	732	if (newH <= h \|\| line <= 0 \|\| newH >= (INT_MAX - 1) / line) {
724	return;	733	return;
725	}	734	}
726	// need to allocate one extra guard byte for use in combine()	735	// need to allocate one extra guard byte for use in combine()
Lines 2294-2299 Link Here
2294	!readUWord(&stepX) \|\| !readUWord(&stepY)) {	2303	!readUWord(&stepX) \|\| !readUWord(&stepY)) {
2295	goto eofError;	2304	goto eofError;
2296	}	2305	}
		2306	if (w == 0 \|\| h == 0 \|\| w >= INT_MAX / h) {
		2307	error(getPos(), "Bad bitmap size in JBIG2 halftone segment");
		2308	return;
		2309	}
		2310	if (gridH == 0 \|\| gridW >= INT_MAX / gridH) {
		2311	error(getPos(), "Bad grid size in JBIG2 halftone segment");
		2312	return;
		2313	}
2297		2314
2298	// get pattern dictionary	2315	// get pattern dictionary
2299	if (nRefSegs != 1) {	2316	if (nRefSegs != 1) {




#pragma implementation
#endif

#include <limits.h>
#include "gmem.h"
#include "Error.h"
#include "JArithmeticDecoder.h"

		for (pre = 0; pre < 1; ++pre) {
		  precinct = &resLevel->precincts[pre];
		  if (precinct->subbands) {
		    for (sb = 0; sb < (Guint)(r == 0 ? 1 : 3); ++sb) {
		      subband = &precinct->subbands[sb];
		      gfree(subband->inclusion);
		      gfree(subband->zeroBitPlane);

  int segType;
  GBool haveSIZ, haveCOD, haveQCD, haveSOT;
  Guint precinctSize, style;
  Guint segLen, capabilities, nTiles, comp, i, j, r;

  //----- main header
  haveSIZ = haveCOD = haveQCD = haveSOT = gFalse;

	            / img.xTileSize;
      img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1)
	            / img.yTileSize;
      nTiles = img.nXTiles * img.nYTiles;
      // check for overflow before allocating memory
      if (img.nXTiles <= 0 || img.nYTiles <= 0 ||
	  img.nXTiles >= INT_MAX / img.nYTiles) {
	error(getPos(), "Bad tile count in JPX SIZ marker segment");
	return gFalse;
      }
      img.tiles = (JPXTile *)gmallocn(nTiles, sizeof(JPXTile));
      for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {
	img.tiles[i].tileComps = (JPXTileComp *)gmallocn(img.nComps,
							 sizeof(JPXTileComp));

    }
    if (!bits) {
      // packet is empty -- clear all code-block inclusion flags
      for (sb = 0; sb < (Guint)(tile->res == 0 ? 1 : 3); ++sb) {
	subband = &precinct->subbands[sb];
	for (cbY = 0; cbY < subband->nYCBs; ++cbY) {
	  for (cbX = 0; cbX < subband->nXCBs; ++cbX) {

      }
    } else {

      for (sb = 0; sb < (Guint)(tile->res == 0 ? 1 : 3); ++sb) {
	subband = &precinct->subbands[sb];
	for (cbY = 0; cbY < subband->nYCBs; ++cbY) {
	  for (cbX = 0; cbX < subband->nXCBs; ++cbX) {


    //----- packet data

    for (sb = 0; sb < (Guint)(tile->res == 0 ? 1 : 3); ++sb) {
      subband = &precinct->subbands[sb];
      for (cbY = 0; cbY < subband->nYCBs; ++cbY) {
	for (cbX = 0; cbX < subband->nXCBs; ++cbX) {

Lines 34-40 Link Here

(-)TeX.orig/libs/xpdf/xpdf/SecurityHandler.cc (+2 lines)
34	SecurityHandler SecurityHandler::make(PDFDoc docA, Object *encryptDictA) {	34	SecurityHandler SecurityHandler::make(PDFDoc docA, Object *encryptDictA) {
35	Object filterObj;	35	Object filterObj;
36	SecurityHandler *secHdlr;	36	SecurityHandler *secHdlr;
		37	#ifdef ENABLE_PLUGINS
37	XpdfSecurityHandler *xsh;	38	XpdfSecurityHandler *xsh;
		39	#endif
38		40
39	encryptDictA->dictLookup("Filter", &filterObj);	41	encryptDictA->dictLookup("Filter", &filterObj);
40	if (filterObj.isName("Standard")) {	42	if (filterObj.isName("Standard")) {

Lines 15-20 Link Here

(-)TeX.orig/libs/xpdf/xpdf/Stream.cc (-1 / +53 lines)
15	#include <stdio.h>	15	#include <stdio.h>
16	#include <stdlib.h>	16	#include <stdlib.h>
17	#include <stddef.h>	17	#include <stddef.h>
		18	#include <limits.h>
18	#ifndef WIN32	19	#ifndef WIN32
19	#include <unistd.h>	20	#include <unistd.h>
20	#endif	21	#endif
Lines 401-418 Link Here
401		402
402	StreamPredictor::StreamPredictor(Stream *strA, int predictorA,	403	StreamPredictor::StreamPredictor(Stream *strA, int predictorA,
403	int widthA, int nCompsA, int nBitsA) {	404	int widthA, int nCompsA, int nBitsA) {
		405	int totalBits;
		406
404	str = strA;	407	str = strA;
405	predictor = predictorA;	408	predictor = predictorA;
406	width = widthA;	409	width = widthA;
407	nComps = nCompsA;	410	nComps = nCompsA;
408	nBits = nBitsA;	411	nBits = nBitsA;
		412	predLine = NULL;
		413	ok = gFalse;
409		414
410	nVals = width * nComps;	415	nVals = width * nComps;
		416	totalBits = nVals * nBits;
		417	if (width <= 0 \|\| nComps <= 0 \|\| nBits <= 0 \|\|
		418	nComps >= INT_MAX / nBits \|\|
		419	width >= INT_MAX / nComps / nBits \|\|
		420	nVals * nBits + 7 < 0) {
		421	return;
		422	}
411	pixBytes = (nComps * nBits + 7) >> 3;	423	pixBytes = (nComps * nBits + 7) >> 3;
412	rowBytes = ((nVals * nBits + 7) >> 3) + pixBytes;	424	rowBytes = ((totalBits + 7) >> 3) + pixBytes;
		425	if (rowBytes < 0) {
		426	return;
		427	}
413	predLine = (Guchar *)gmalloc(rowBytes);	428	predLine = (Guchar *)gmalloc(rowBytes);
414	memset(predLine, 0, rowBytes);	429	memset(predLine, 0, rowBytes);
415	predIdx = rowBytes;	430	predIdx = rowBytes;
		431
		432	ok = gTrue;
416	}	433	}
417		434
418	StreamPredictor::~StreamPredictor() {	435	StreamPredictor::~StreamPredictor() {
Lines 1004-1009 Link Here
1004	FilterStream(strA) {	1021	FilterStream(strA) {
1005	if (predictor != 1) {	1022	if (predictor != 1) {
1006	pred = new StreamPredictor(this, predictor, columns, colors, bits);	1023	pred = new StreamPredictor(this, predictor, columns, colors, bits);
		1024	if (!pred->isOk()) {
		1025	delete pred;
		1026	pred = NULL;
		1027	}
1007	} else {	1028	} else {
1008	pred = NULL;	1029	pred = NULL;
1009	}	1030	}
Lines 1259-1264 Link Here
1259	if (columns < 1) {	1280	if (columns < 1) {
1260	columns = 1;	1281	columns = 1;
1261	}	1282	}
		1283	if (columns + 4 <= 0) {
		1284	columns = INT_MAX - 4;
		1285	}
1262	rows = rowsA;	1286	rows = rowsA;
1263	endOfBlock = endOfBlockA;	1287	endOfBlock = endOfBlockA;
1264	black = blackA;	1288	black = blackA;
Lines 2899-2904 Link Here
2899	height = read16();	2923	height = read16();
2900	width = read16();	2924	width = read16();
2901	numComps = str->getChar();	2925	numComps = str->getChar();
		2926	if (numComps <= 0 \|\| numComps > 4) {
		2927	error(getPos(), "Bad number of components in DCT stream", prec);
		2928	return gFalse;
		2929	}
		2930	if (numComps <= 0 \|\| numComps > 4) {
		2931	error(getPos(), "Bad number of components in DCT stream", prec);
		2932	return gFalse;
		2933	}
2902	if (prec != 8) {	2934	if (prec != 8) {
2903	error(getPos(), "Bad DCT precision %d", prec);	2935	error(getPos(), "Bad DCT precision %d", prec);
2904	return gFalse;	2936	return gFalse;
Lines 2925-2930 Link Here
2925	height = read16();	2957	height = read16();
2926	width = read16();	2958	width = read16();
2927	numComps = str->getChar();	2959	numComps = str->getChar();
		2960	if (numComps <= 0 \|\| numComps > 4) {
		2961	error(getPos(), "Bad number of components in DCT stream");
		2962	numComps = 0;
		2963	return gFalse;
		2964	}
		2965	if (numComps <= 0 \|\| numComps > 4) {
		2966	error(getPos(), "Bad number of components in DCT stream");
		2967	numComps = 0;
		2968	return gFalse;
		2969	}
2928	if (prec != 8) {	2970	if (prec != 8) {
2929	error(getPos(), "Bad DCT precision %d", prec);	2971	error(getPos(), "Bad DCT precision %d", prec);
2930	return gFalse;	2972	return gFalse;
Lines 2947-2952 Link Here
2947		2989
2948	length = read16() - 2;	2990	length = read16() - 2;
2949	scanInfo.numComps = str->getChar();	2991	scanInfo.numComps = str->getChar();
		2992	if (scanInfo.numComps <= 0 \|\| scanInfo.numComps > 4) {
		2993	error(getPos(), "Bad number of components in DCT stream");
		2994	scanInfo.numComps = 0;
		2995	return gFalse;
		2996	}
2950	--length;	2997	--length;
2951	if (length != 2 * scanInfo.numComps + 3) {	2998	if (length != 2 * scanInfo.numComps + 3) {
2952	error(getPos(), "Bad DCT scan info block");	2999	error(getPos(), "Bad DCT scan info block");
Lines 3041-3046 Link Here
3041	numACHuffTables = index+1;	3088	numACHuffTables = index+1;
3042	tbl = &acHuffTables[index];	3089	tbl = &acHuffTables[index];
3043	} else {	3090	} else {
		3091	index &= 0x0f;
3044	if (index >= numDCHuffTables)	3092	if (index >= numDCHuffTables)
3045	numDCHuffTables = index+1;	3093	numDCHuffTables = index+1;
3046	tbl = &dcHuffTables[index];	3094	tbl = &dcHuffTables[index];
Lines 3827-3832 Link Here
3827	FilterStream(strA) {	3875	FilterStream(strA) {
3828	if (predictor != 1) {	3876	if (predictor != 1) {
3829	pred = new StreamPredictor(this, predictor, columns, colors, bits);	3877	pred = new StreamPredictor(this, predictor, columns, colors, bits);
		3878	if (!pred->isOk()) {
		3879	delete pred;
		3880	pred = NULL;
		3881	}
3830	} else {	3882	} else {
3831	pred = NULL;	3883	pred = NULL;
3832	}	3884	}

Lines 232-237 Link Here

(-)TeX.orig/libs/xpdf/xpdf/Stream.h (+3 lines)
232		232
233	~StreamPredictor();	233	~StreamPredictor();
234		234
		235	GBool isOk() { return ok; }
		236
235	int lookChar();	237	int lookChar();
236	int getChar();	238	int getChar();
237		239
Lines 249-254 Link Here
249	int rowBytes; // bytes per line	251	int rowBytes; // bytes per line
250	Guchar *predLine; // line buffer	252	Guchar *predLine; // line buffer
251	int predIdx; // current index in predLine	253	int predIdx; // current index in predLine
		254	GBool ok;
252	};	255	};
253		256
254	//------------------------------------------------------------------------	257	//------------------------------------------------------------------------

Return to bug 135385

Lines 11-16 Link Here

(-)TeX.orig/libs/xpdf/goo/gmem.c (-6 / +16 lines)
11	#include <stdlib.h>	11	#include <stdlib.h>
12	#include <stddef.h>	12	#include <stddef.h>
13	#include <string.h>	13	#include <string.h>
		14	#include <limits.h>
14	#include "gmem.h"	15	#include "gmem.h"
15		16
16	#ifdef DEBUG_MEM	17	#ifdef DEBUG_MEM
Lines 63-69 Link Here
63	int lst;	64	int lst;
64	unsigned long trl, p;	65	unsigned long trl, p;
65		66
66	if (size == 0)	67	if (size <= 0)
67	return NULL;	68	return NULL;
68	size1 = gMemDataSize(size);	69	size1 = gMemDataSize(size);
69	if (!(mem = (char *)malloc(size1 + gMemHdrSize + gMemTrlSize))) {	70	if (!(mem = (char *)malloc(size1 + gMemHdrSize + gMemTrlSize))) {
Lines 86-92 Link Here
86	#else	87	#else
87	void *p;	88	void *p;
88		89
89	if (size == 0)	90	if (size <= 0)
90	return NULL;	91	return NULL;
91	if (!(p = malloc(size))) {	92	if (!(p = malloc(size))) {
92	fprintf(stderr, "Out of memory\n");	93	fprintf(stderr, "Out of memory\n");
Lines 102-108 Link Here
102	void *q;	103	void *q;
103	int oldSize;	104	int oldSize;
104		105
105	if (size == 0) {	106	if (size <= 0) {
106	if (p)	107	if (p)
107	gfree(p);	108	gfree(p);
108	return NULL;	109	return NULL;
Lines 120-126 Link Here
120	#else	121	#else
121	void *q;	122	void *q;
122		123
123	if (size == 0) {	124	if (size <= 0) {
124	if (p)	125	if (p)
125	free(p);	126	free(p);
126	return NULL;	127	return NULL;
Lines 140-147 Link Here
140	void *gmallocn(int nObjs, int objSize) {	141	void *gmallocn(int nObjs, int objSize) {
141	int n;	142	int n;
142		143
		144	if (nObjs == 0) {
		145	return NULL;
		146	}
143	n = nObjs * objSize;	147	n = nObjs * objSize;
144	if (objSize == 0 \|\| n / objSize != nObjs) {	148	if (objSize <= 0 \|\| nObjs < 0 \|\| nObjs >= INT_MAX / objSize) {
145	fprintf(stderr, "Bogus memory allocation size\n");	149	fprintf(stderr, "Bogus memory allocation size\n");
146	exit(1);	150	exit(1);
147	}	151	}
Lines 151-158 Link Here
151	void greallocn(void p, int nObjs, int objSize) {	155	void greallocn(void p, int nObjs, int objSize) {
152	int n;	156	int n;
153		157
		158	if (nObjs == 0) {
		159	if (p) {
		160	gfree(p);
		161	}
		162	return NULL;
		163	}
154	n = nObjs * objSize;	164	n = nObjs * objSize;
155	if (objSize == 0 \|\| n / objSize != nObjs) {	165	if (objSize <= 0 \|\| nObjs < 0 \|\| nObjs >= INT_MAX / objSize) {
156	fprintf(stderr, "Bogus memory allocation size\n");	166	fprintf(stderr, "Bogus memory allocation size\n");
157	exit(1);	167	exit(1);
158	}	168	}

Lines 12-17 Link Here

(-)TeX.orig/libs/xpdf/xpdf/JPXStream.cc (-7 / +14 lines)
12	#pragma implementation	12	#pragma implementation
13	#endif	13	#endif
14		14
		15	#include <limits.h>
15	#include "gmem.h"	16	#include "gmem.h"
16	#include "Error.h"	17	#include "Error.h"
17	#include "JArithmeticDecoder.h"	18	#include "JArithmeticDecoder.h"
Lines 235-241 Link Here
235	for (pre = 0; pre < 1; ++pre) {	236	for (pre = 0; pre < 1; ++pre) {
236	precinct = &resLevel->precincts[pre];	237	precinct = &resLevel->precincts[pre];
237	if (precinct->subbands) {	238	if (precinct->subbands) {
238	for (sb = 0; sb < (r == 0 ? 1 : 3); ++sb) {	239	for (sb = 0; sb < (Guint)(r == 0 ? 1 : 3); ++sb) {
239	subband = &precinct->subbands[sb];	240	subband = &precinct->subbands[sb];
240	gfree(subband->inclusion);	241	gfree(subband->inclusion);
241	gfree(subband->zeroBitPlane);	242	gfree(subband->zeroBitPlane);
Lines 783-789 Link Here
783	int segType;	784	int segType;
784	GBool haveSIZ, haveCOD, haveQCD, haveSOT;	785	GBool haveSIZ, haveCOD, haveQCD, haveSOT;
785	Guint precinctSize, style;	786	Guint precinctSize, style;
786	Guint segLen, capabilities, comp, i, j, r;	787	Guint segLen, capabilities, nTiles, comp, i, j, r;
787		788
788	//----- main header	789	//----- main header
789	haveSIZ = haveCOD = haveQCD = haveSOT = gFalse;	790	haveSIZ = haveCOD = haveQCD = haveSOT = gFalse;
Lines 818-825 Link Here
818	/ img.xTileSize;	819	/ img.xTileSize;
819	img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1)	820	img.nYTiles = (img.ySize - img.yTileOffset + img.yTileSize - 1)
820	/ img.yTileSize;	821	/ img.yTileSize;
821	img.tiles = (JPXTile )gmallocn(img.nXTiles img.nYTiles,	822	nTiles = img.nXTiles * img.nYTiles;
822	sizeof(JPXTile));	823	// check for overflow before allocating memory
		824	if (img.nXTiles <= 0 \|\| img.nYTiles <= 0 \|\|
		825	img.nXTiles >= INT_MAX / img.nYTiles) {
		826	error(getPos(), "Bad tile count in JPX SIZ marker segment");
		827	return gFalse;
		828	}
		829	img.tiles = (JPXTile *)gmallocn(nTiles, sizeof(JPXTile));
823	for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {	830	for (i = 0; i < img.nXTiles * img.nYTiles; ++i) {
824	img.tiles[i].tileComps = (JPXTileComp *)gmallocn(img.nComps,	831	img.tiles[i].tileComps = (JPXTileComp *)gmallocn(img.nComps,
825	sizeof(JPXTileComp));	832	sizeof(JPXTileComp));
Lines 1827-1833 Link Here
1827	}	1834	}
1828	if (!bits) {	1835	if (!bits) {
1829	// packet is empty -- clear all code-block inclusion flags	1836	// packet is empty -- clear all code-block inclusion flags
1830	for (sb = 0; sb < (tile->res == 0 ? 1 : 3); ++sb) {	1837	for (sb = 0; sb < (Guint)(tile->res == 0 ? 1 : 3); ++sb) {
1831	subband = &precinct->subbands[sb];	1838	subband = &precinct->subbands[sb];
1832	for (cbY = 0; cbY < subband->nYCBs; ++cbY) {	1839	for (cbY = 0; cbY < subband->nYCBs; ++cbY) {
1833	for (cbX = 0; cbX < subband->nXCBs; ++cbX) {	1840	for (cbX = 0; cbX < subband->nXCBs; ++cbX) {
Lines 1838-1844 Link Here
1838	}	1845	}
1839	} else {	1846	} else {
1840		1847
1841	for (sb = 0; sb < (tile->res == 0 ? 1 : 3); ++sb) {	1848	for (sb = 0; sb < (Guint)(tile->res == 0 ? 1 : 3); ++sb) {
1842	subband = &precinct->subbands[sb];	1849	subband = &precinct->subbands[sb];
1843	for (cbY = 0; cbY < subband->nYCBs; ++cbY) {	1850	for (cbY = 0; cbY < subband->nYCBs; ++cbY) {
1844	for (cbX = 0; cbX < subband->nXCBs; ++cbX) {	1851	for (cbX = 0; cbX < subband->nXCBs; ++cbX) {
Lines 1983-1989 Link Here
1983		1990
1984	//----- packet data	1991	//----- packet data
1985		1992
1986	for (sb = 0; sb < (tile->res == 0 ? 1 : 3); ++sb) {	1993	for (sb = 0; sb < (Guint)(tile->res == 0 ? 1 : 3); ++sb) {
1987	subband = &precinct->subbands[sb];	1994	subband = &precinct->subbands[sb];
1988	for (cbY = 0; cbY < subband->nYCBs; ++cbY) {	1995	for (cbY = 0; cbY < subband->nYCBs; ++cbY) {
1989	for (cbX = 0; cbX < subband->nXCBs; ++cbX) {	1996	for (cbX = 0; cbX < subband->nXCBs; ++cbX) {