tree c4d36ad566cee23901d476a79eb316d02a0c1c08
parent 74dbc8af75f9dc2490e498f3de57c84edb2fb4fe
author Alan Screen <awscreen@chromium.org> 1570669279 +0000
committer Chromium commit bot <commit-bot@chromium.org> 1570669279 +0000

[lcms] Clusterfuzz - avoid secondary integer overflow

In [1] changes were made to avoid a detected overflow.  As noted from
tests with patch set 15 of that CL there was a performance issue when
clamping the inputs to _MatShaperEvaluateRow(), and it was decided to
try using doing the matrix evaluation with 64bit.

Now that fuzzing has exposed that as insufficient, bring back clamping.
Use an improvement over prior attempts by anticipating typically good
input so that only one extra conditional check is introduced instead of
two for regularly expected input.

This has been rolled into the prior 0033-opt-integer-overflow.patch.

[1] https://pdfium-review.googlesource.com/c/pdfium/+/60030

Bug: chromium:1009235
Change-Id: Ibe1d72464057db4d9628fd9fc67b76ad98e6b29c
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/61211
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>