Validate more inputs in CPDF_Function::Call().
Per table 38 in the PDF spec, for each pair of values in the domain, the
first value has to be less than or equal to the second value. Validate
this and reject functions with invalidate domains. Do the same for the
range.
This avoids passing values to pdfium::clamp() where the "low" value is
higher than the "high" value. Since pdfium::clamp() is now compliant
with std::clamp(), the extra validation from this CL avoids undefined
behavior.
Bug: chromium:1235105
Change-Id: I548a36c009bb4267aadf127db2346aa85f1e9384
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/83810
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
diff --git a/core/fpdfapi/page/cpdf_function.cpp b/core/fpdfapi/page/cpdf_function.cpp
index 823e00e..77cdb1e 100644
--- a/core/fpdfapi/page/cpdf_function.cpp
+++ b/core/fpdfapi/page/cpdf_function.cpp
@@ -133,8 +133,12 @@
std::vector<float> clamped_inputs(m_nInputs);
for (uint32_t i = 0; i < m_nInputs; i++) {
- clamped_inputs[i] =
- pdfium::clamp(inputs[i], m_Domains[i * 2], m_Domains[i * 2 + 1]);
+ float domain1 = m_Domains[i * 2];
+ float domain2 = m_Domains[i * 2 + 1];
+ if (domain1 > domain2)
+ return pdfium::nullopt;
+
+ clamped_inputs[i] = pdfium::clamp(inputs[i], domain1, domain2);
}
if (!v_Call(clamped_inputs, results))
return pdfium::nullopt;
@@ -143,8 +147,12 @@
return m_nOutputs;
for (uint32_t i = 0; i < m_nOutputs; i++) {
- results[i] =
- pdfium::clamp(results[i], m_Ranges[i * 2], m_Ranges[i * 2 + 1]);
+ float range1 = m_Ranges[i * 2];
+ float range2 = m_Ranges[i * 2 + 1];
+ if (range1 > range2)
+ return pdfium::nullopt;
+
+ results[i] = pdfium::clamp(results[i], range1, range2);
}
return m_nOutputs;
}
