commit 6314d23c98a60837735ab921b64608704058e9e8
author Lei Zhang <thestig@chromium.org> Tue Jul 09 19:16:07 2019 +0000
committer Chromium commit bot <commit-bot@chromium.org> Tue Jul 09 19:16:07 2019 +0000
tree 2565a0f06dae84bdbfb86d89532239f913b857ea
parent babd1d4ac7c4060fb907ac90ee08f52c603c6358

Fix a comparison in CLZWDecoder::Decode().

In CLZWDecoder::Decode(), |old_code| can never hold the value of 256 or
257. So change an incorrect looking comparison and stop worrying about
the case where a subtraction from |old_code| may cause an integer
underflow.

Change-Id: I49330c89f831112df932207e0f5520e8c4ad89af
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/57390
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

core/fxcodec/flate/flatemodule.cpp

diff --git a/core/fxcodec/flate/flatemodule.cpp b/core/fxcodec/flate/flatemodule.cpp
index 6038fa7..d6dfb69 100644
--- a/core/fxcodec/flate/flatemodule.cpp
+++ b/core/fxcodec/flate/flatemodule.cpp
@@ -218,6 +218,7 @@
     if (old_code == 0xFFFFFFFF)
       return false;
 
+    ASSERT(old_code < 256 || old_code >= 258);
     stack_len_ = 0;
     if (code - 258 >= current_code_) {
       if (stack_len_ < sizeof(decode_stack_))
@@ -235,8 +236,7 @@
     }
     dest_byte_pos_ += stack_len_;
     last_char = decode_stack_[stack_len_ - 1];
-    // TODO(thestig): What happens if |old_code| is 257?
-    if (old_code >= 256 && old_code - 258 >= current_code_)
+    if (old_code >= 258 && old_code - 258 >= current_code_)
       break;
 
     AddCode(old_code, last_char);