|
 |
ea5d11 |
From ab4d21b69bf0717ac93072d24b076681bdb9b3a4 Mon Sep 17 00:00:00 2001
|
|
|
ea5d11 |
From: Chris Liddell <chris.liddell@artifex.com>
|
|
|
ea5d11 |
Date: Wed, 19 Jun 2013 16:25:17 +0100
|
|
|
ea5d11 |
Subject: [PATCH] Bug 693934: CCITT Fax decode - cope with negative run length
|
|
|
ea5d11 |
|
|
|
ea5d11 |
In various places in the fax decode code we coped with the run length being
|
|
|
ea5d11 |
negative - in just a few we didn't.
|
|
|
ea5d11 |
|
|
|
ea5d11 |
We'll now cope gracefully with negative run lengths in places.
|
|
|
ea5d11 |
|
|
|
ea5d11 |
No cluster differences.
|
|
|
ea5d11 |
---
|
|
|
ea5d11 |
base/scfd.c | 13 +++++++++++++
|
|
|
ea5d11 |
1 file changed, 13 insertions(+)
|
|
|
ea5d11 |
|
|
|
ea5d11 |
diff --git a/base/scfd.c b/base/scfd.c
|
|
|
ea5d11 |
index 970c925..5f7f798 100644
|
|
|
ea5d11 |
--- a/base/scfd.c
|
|
|
ea5d11 |
+++ b/base/scfd.c
|
|
|
ea5d11 |
@@ -611,6 +611,7 @@ v0: skip_bits(1);
|
|
|
ea5d11 |
rlen, "[w2]", d2l, out0);
|
|
|
ea5d11 |
/* rlen may be run2_pass, run_uncompressed, or */
|
|
|
ea5d11 |
/* 0..countof(cf2_run_vertical)-1. */
|
|
|
ea5d11 |
+rlen_lt_zero:
|
|
|
ea5d11 |
if (rlen < 0)
|
|
|
ea5d11 |
switch (rlen) {
|
|
|
ea5d11 |
case run2_pass:
|
|
|
ea5d11 |
@@ -726,6 +727,9 @@ v0: skip_bits(1);
|
|
|
ea5d11 |
status = ERRC;
|
|
|
ea5d11 |
goto out;
|
|
|
ea5d11 |
}
|
|
|
ea5d11 |
+
|
|
|
ea5d11 |
+ if (rlen < 0) goto rlen_lt_zero;
|
|
|
ea5d11 |
+
|
|
|
ea5d11 |
skip_data(rlen, hww);
|
|
|
ea5d11 |
/* Handle the second half of a white-black horizontal code. */
|
|
|
ea5d11 |
hwb:get_run(cf_black_decode, cfd_black_initial_bits, cfd_black_min_bits,
|
|
|
ea5d11 |
@@ -734,6 +738,9 @@ v0: skip_bits(1);
|
|
|
ea5d11 |
status = ERRC;
|
|
|
ea5d11 |
goto out;
|
|
|
ea5d11 |
}
|
|
|
ea5d11 |
+
|
|
|
ea5d11 |
+ if (rlen < 0) goto rlen_lt_zero;
|
|
|
ea5d11 |
+
|
|
|
ea5d11 |
invert_data(rlen, black_byte, goto hwb, ihwb);
|
|
|
ea5d11 |
goto top;
|
|
|
ea5d11 |
outww:ss->run_color = -2;
|
|
|
ea5d11 |
@@ -747,6 +754,9 @@ v0: skip_bits(1);
|
|
|
ea5d11 |
status = ERRC;
|
|
|
ea5d11 |
goto out;
|
|
|
ea5d11 |
}
|
|
|
ea5d11 |
+
|
|
|
ea5d11 |
+ if (rlen < 0) goto rlen_lt_zero;
|
|
|
ea5d11 |
+
|
|
|
ea5d11 |
invert_data(rlen, black_byte, goto hbb, ihbb);
|
|
|
ea5d11 |
/* Handle the second half of a black-white horizontal code. */
|
|
|
ea5d11 |
hbw:get_run(cf_white_decode, cfd_white_initial_bits, cfd_white_min_bits,
|
|
|
ea5d11 |
@@ -755,6 +765,9 @@ v0: skip_bits(1);
|
|
|
ea5d11 |
status = ERRC;
|
|
|
ea5d11 |
goto out;
|
|
|
ea5d11 |
}
|
|
|
ea5d11 |
+
|
|
|
ea5d11 |
+ if (rlen < 0) goto rlen_lt_zero;
|
|
|
ea5d11 |
+
|
|
|
ea5d11 |
skip_data(rlen, hbw);
|
|
|
ea5d11 |
goto top;
|
|
|
ea5d11 |
outbb:ss->run_color = 2;
|
|
|
ea5d11 |
--
|
|
|
ea5d11 |
2.9.4
|
|
|
ea5d11 |
|