Attachment 61073 Details for Bug 49523 – Avoid bogus memory allocation size

[patch] Avoid bogus memory allocation size

49523.diff (text/plain), 1.38 KB, created by Thomas Freitag on 2012-05-05 03:36:03 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Freitag

Created: 2012-05-05 03:36:03 UTC

Size: 1.38 KB

patch

obsolete

>diff --git a/splash/Splash.cc b/splash/Splash.cc
>index 047bbe8..5402fdf 100644
>--- a/splash/Splash.cc
>+++ b/splash/Splash.cc
>@@ -3573,26 +3573,26 @@ SplashError Splash::arbitraryTransformImage(SplashImageSource src, void *srcData
>     t0 = imgCoordMungeUpper(mat[2] + mat[4]) - imgCoordMungeLower(mat[4]);
>     if (splashAbs(mat[1]) >= 1) {
>       th = imgCoordMungeUpper(mat[2]) - imgCoordMungeLower(mat[0] * mat[3] / mat[1]);
>-	  if (th > t0) t0 = th;
>+	  if (th > t0 && th < 10000) t0 = th;
>     }
>   } else {
>     t0 = imgCoordMungeUpper(mat[4]) - imgCoordMungeLower(mat[2] + mat[4]);
>     if (splashAbs(mat[1]) >= 1) {
>       th = imgCoordMungeUpper(mat[0] * mat[3] / mat[1]) - imgCoordMungeLower(mat[2]);
>-      if (th > t0) t0 = th;
>+      if (th > t0 && th < 10000) t0 = th;
>     }
>   }
>   if (mat[3] >= 0) {
>     t1 = imgCoordMungeUpper(mat[3] + mat[5]) - imgCoordMungeLower(mat[5]);
>     if (splashAbs(mat[0]) >= 1) {
>       th = imgCoordMungeUpper(mat[3]) - imgCoordMungeLower(mat[1] * mat[2] / mat[0]);
>-	  if (th > t1) t1 = th;
>+	  if (th > t1 && th < 10000) t1 = th;
>     }
>   } else {
>     t1 = imgCoordMungeUpper(mat[5]) - imgCoordMungeLower(mat[3] + mat[5]);
>     if (splashAbs(mat[0]) >= 1) {
>       th = imgCoordMungeUpper(mat[1] * mat[2] / mat[0]) - imgCoordMungeLower(mat[3]);
>-	  if (th > t1) t1 = th;
>+	  if (th > t1 && th < 10000) t1 = th;
>     }
>   }
>   scaledHeight = t0 > t1 ? t0 : t1;

Actions: View | Splinter Review

Attachments on bug 49523: 61073 | 61476 | 61739 | 63422

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.