| commit | 74742a75ac7a07c08cf36fe6f4eaa91bed8236a3 | [log] [tgz] |
|---|---|---|
| author | Tom Sepez <tsepez@chromium.org> | Tue Jun 30 12:18:55 2015 -0700 |
| committer | Tom Sepez <tsepez@chromium.org> | Tue Jun 30 12:18:55 2015 -0700 |
| tree | cd7863a159b4c8dd691aa280efee56158e1ee42e | |
| parent | c01c977c9c6e56faf709400547c9b085b8972024 [diff] |
Redo range check in CPDF_SampledFunc::v_Call(). The current |bitpos1| calculation protects the passed argument to _GetBits32(): |bitpos.ValueOrDie() + j * m_nBitsPerSample|, but doesn't account for adding in the sample length in that routine. Also bound bits per sample to something reasonable to avoid undefined behaviour on the shift to compute the max value. BUG=471990 R=jun_fang@foxitsoftware.com Review URL: https://codereview.chromium.org/1219663003.