commit 5c1673db6deae2e1858c4ffc3b3a0b79901dd827
author Nicolas Pena <npm@chromium.org> Wed Jan 25 11:09:09 2017 -0500
committer Chromium commit bot <commit-bot@chromium.org> Wed Jan 25 23:25:24 2017 +0000
tree 51541b0c1af8f127eed6a4f8e75d5916793565a8
parent 4fc34fa8376dd5cd119606ba6e0dd7e08d23ac38

Calculate code_store safely in CGifLZWDecoder::Decode

BUG=682628

Change-Id: I8e88cc0c8392b078afb73f9549ea4dea9a5717fd
Reviewed-on: https://pdfium-review.googlesource.com/2390
Commit-Queue: Nicolás Peña <npm@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>

core/fxcodec/lgif/fx_gif.cpp

diff --git a/core/fxcodec/lgif/fx_gif.cpp b/core/fxcodec/lgif/fx_gif.cpp
index 93db181..d62dacb 100644
--- a/core/fxcodec/lgif/fx_gif.cpp
+++ b/core/fxcodec/lgif/fx_gif.cpp
@@ -114,7 +114,17 @@
           FXSYS_strncpy(err_msg_ptr, "Decode Error", GIF_MAX_ERROR_SIZE - 1);
         return 0;
       }
-      code_store |= (*next_in++) << bits_left;
+      pdfium::base::CheckedNumeric<uint32_t> safe_code = *next_in++;
+      safe_code <<= bits_left;
+      safe_code |= code_store;
+      if (!safe_code.IsValid()) {
+        if (err_msg_ptr) {
+          FXSYS_strncpy(err_msg_ptr, "Code Store Out Of Range",
+                        GIF_MAX_ERROR_SIZE - 1);
+        }
+        return 0;
+      }
+      code_store = safe_code.ValueOrDie();
       avail_in--;
       bits_left += 8;
     }