Increase jbig2 limits and roll jbig2 testing corpus Real-world PDF files contain jbig2 symbol dictionaries with more than 65535 symbols (see bug for one with 173132), so bump up the limit 16x. Also picks up https://pdfium-review.googlesource.com/c/pdfium_tests/+/157510 which contains a synthetic text with 2**18 symbols in its symbol dict. The new test used to time out before these two: https://pdfium-review.googlesource.com/c/pdfium/+/157550 https://pdfium-review.googlesource.com/c/pdfium/+/157830 Bug: 555145149 Change-Id: I22d9fabb82c8d888dcfd9b295dc937f327e19ab9 Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/157530 Auto-Submit: Nico Weber <thakis@chromium.org> Reviewed-by: Nico Weber <thakis@google.com> Reviewed-by: Lei Zhang <thestig@chromium.org> Commit-Queue: Lei Zhang <thestig@chromium.org>
diff --git a/DEPS b/DEPS index 7e4aff8..de98e50 100644 --- a/DEPS +++ b/DEPS
@@ -224,7 +224,7 @@ # Three lines of non-changing comments so that # the commit queue can handle CLs rolling pdfium_tests # and whatever else without interference from each other. - 'pdfium_tests_revision': 'd4ec3e1987a094b1eae612943b57782d3b0038ff', + 'pdfium_tests_revision': '59ed3059c846ef5f92865d933fb705db55b1dc45', # Three lines of non-changing comments so that # the commit queue can handle CLs rolling result_adapter_revision # and whatever else without interference from each other.
diff --git a/core/fxcodec/jbig2/jbig2_define.h b/core/fxcodec/jbig2/jbig2_define.h index d705460..a4c770a 100644 --- a/core/fxcodec/jbig2/jbig2_define.h +++ b/core/fxcodec/jbig2/jbig2_define.h
@@ -19,9 +19,11 @@ constexpr int32_t kJBig2OOB = 1; +// Somewhat arbitrary limits to limit damage done by malicious inputs. +// Should be well above what's found in real-world files. constexpr int32_t kJBig2MaxReferredSegmentCount = 64; -constexpr uint32_t kJBig2MaxExportSymbols = 65535; -constexpr uint32_t kJBig2MaxNewSymbols = 65535; +constexpr uint32_t kJBig2MaxExportSymbols = 1 << 20; +constexpr uint32_t kJBig2MaxNewSymbols = 1 << 20; constexpr uint32_t kJBig2MaxPatternIndex = 65535; constexpr int32_t kJBig2MaxImageSize = 65535;