dany/pdfio
1
0
Fork 0
mirror of https://github.com/michaelrsweet/pdfio.git synced 2025-04-19 23:16:48 +02:00
Code Issues Packages Projects Releases Wiki Activity

Range check dictionary values in pdfioImageGetBytesPerLine (Issue #121)

Browse Source
This commit is contained in:
Michael R Sweet 2025-04-12 14:33:13 -04:00
parent 0391df5bbd
commit 755efe08da
No known key found for this signature in database
GPG Key ID: BE67C75EC81F3244
2 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGES.md
View File

@ -11,6 +11,7 @@ v1.5.2 - YYYY-MM-DD
- Fixed form detection in `pdfioinfo` example code (Issue #114) - Fixed form detection in `pdfioinfo` example code (Issue #114)
- Fixed parsing of certain date/time values (Issue #115) - Fixed parsing of certain date/time values (Issue #115)
- Fixed support for empty name values (Issue #116) - Fixed support for empty name values (Issue #116)
- Fixed range checking in `pdfioImageGetBytesPerLine` (Issue #121)
v1.5.1 - 2025-03-28 v1.5.1 - 2025-03-28

22
pdfio-content.c
View File

@ -2233,7 +2233,7 @@ pdfioFileCreateImageObjFromFile(
// 'pdfioImageGetBytesPerLine()' - Get the number of bytes to read for each line. // 'pdfioImageGetBytesPerLine()' - Get the number of bytes to read for each line.
// //
size_t // O - Number of bytes per line size_t // O - Number of bytes per line or `0` on error
pdfioImageGetBytesPerLine( pdfioImageGetBytesPerLine(
pdfio_obj_t *obj) // I - Image object pdfio_obj_t *obj) // I - Image object
{ {
@ -2279,7 +2279,25 @@ pdfioImageGetBytesPerLine(
colors = 1; colors = 1;
} }
return ((size_t)((width * colors * bpc + 7) / 8)); if (width < 0)
{
_pdfioFileError(obj->pdf, "Invalid image width %d.", width);
return (0);
}
else if (bpc != 1 && bpc != 2 && bpc != 4 && bpc != 8 && bpc != 16)
{
_pdfioFileError(obj->pdf, "Invalid image bits per component %d.", bpc);
return (0);
}
else if (colors < 1 || colors > 4)
{
_pdfioFileError(obj->pdf, "Invalid image number of colors %d.", colors);
return (0);
}
else
{
return ((size_t)((width * colors * bpc + 7) / 8));
}
} }