shithub: jbig2

Info  •  Files  •  Log  •  Branches

jbig2dec: Handle under-/overflow in arithmetic integer decoder.

--- a/jbig2_arith_int.c

+++ b/jbig2_arith_int.c

@@ -57,7 +57,8 @@

 {

     Jbig2ArithCx *IAx = actx->IAx;

     int PREV = 1;

-    int S, V;

+    int S;

+    int32_t V;

     int bit;

     int n_tail, offset;

     int i;

@@ -129,7 +130,9 @@

         V = (V << 1) | bit;

     }

-    V += offset;

+    /* make sure not to underflow/overflow 32 bit value */

+    if (V < INT32_MAX - 4436 || V > INT32_MIN + 4436)

+        V += offset;

     V = S ? -V : V;

     *p_result = V;

     return S && V == 0 ? 1 : 0;