commit 587ec1975017ecbf13c1c3faf64c1008a95846f2
author kcwu <kcwu@chromium.org> Thu Oct 06 12:29:13 2016 -0700
committer Commit bot <commit-bot@chromium.org> Thu Oct 06 12:29:13 2016 -0700
tree dd05e288f515fe076566d35b17053090a379cd05
parent 065c35006d96eaca324f49248d20d83709a25fbe

Reject JBig2 Huffman table with too large shift value

BUG=chromium:653044

Review-Url: https://codereview.chromium.org/2397783002

core/fxcodec/jbig2/JBig2_HuffmanTable.cpp

diff --git a/core/fxcodec/jbig2/JBig2_HuffmanTable.cpp b/core/fxcodec/jbig2/JBig2_HuffmanTable.cpp
index 3b34018..26f0e52 100644
--- a/core/fxcodec/jbig2/JBig2_HuffmanTable.cpp
+++ b/core/fxcodec/jbig2/JBig2_HuffmanTable.cpp
@@ -64,7 +64,8 @@
   int cur_low = low;
   do {
     if ((pStream->readNBits(HTPS, &PREFLEN[NTEMP]) == -1) ||
-        (pStream->readNBits(HTRS, &RANGELEN[NTEMP]) == -1)) {
+        (pStream->readNBits(HTRS, &RANGELEN[NTEMP]) == -1) ||
+        (static_cast<size_t>(RANGELEN[NTEMP]) >= 8 * sizeof(cur_low))) {
       return false;
     }
     RANGELOW[NTEMP] = cur_low;