commit 4ca5ba4dec653aff28d14c9f48715e93e8dfd490
author Nicolas Pena <npm@chromium.org> Mon Mar 13 15:09:05 2017 -0400
committer Chromium commit bot <commit-bot@chromium.org> Mon Mar 13 19:59:38 2017 +0000
tree 47ec9d81160109cd2686ba9a58da101fe39a2d30
parent 77e2a6c4589dcedb61789beefb1605ba2c0f1aff

Fix boundary value negation in bmp_read_header

When the value read is equal to -INT_MIN, we cannot negate it since it will
be out of bounds, so return error in this case.

BUG=chromium:628559

Change-Id: I7e47a71ef0d35cfb2d1fddc0ba644f9aac79ec3f
Reviewed-on: https://pdfium-review.googlesource.com/2965
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Nicolás Peña <npm@chromium.org>

core/fxcodec/lbmp/fx_bmp.cpp

diff --git a/core/fxcodec/lbmp/fx_bmp.cpp b/core/fxcodec/lbmp/fx_bmp.cpp
index 13525b8..6d4fb51 100644
--- a/core/fxcodec/lbmp/fx_bmp.cpp
+++ b/core/fxcodec/lbmp/fx_bmp.cpp
@@ -7,6 +7,7 @@
 #include "core/fxcodec/lbmp/fx_bmp.h"
 
 #include <algorithm>
+#include <limits>
 
 namespace {
 
@@ -129,6 +130,10 @@
         bmp_ptr->dpi_y = (int32_t)GetDWord_LSBFirst(
             (uint8_t*)&bmp_info_header_ptr->biYPelsPerMeter);
         if (bmp_ptr->height < 0) {
+          if (bmp_ptr->height == std::numeric_limits<int>::min()) {
+            bmp_error(bmp_ptr, "Unsupported height");
+            return 0;
+          }
           bmp_ptr->height = -bmp_ptr->height;
           bmp_ptr->imgTB_flag = true;
         }
@@ -159,6 +164,10 @@
           bmp_ptr->dpi_y = GetDWord_LSBFirst(
               (uint8_t*)&bmp_info_header_ptr->biYPelsPerMeter);
           if (bmp_ptr->height < 0) {
+            if (bmp_ptr->height == std::numeric_limits<int>::min()) {
+              bmp_error(bmp_ptr, "Unsupported height");
+              return 0;
+            }
             bmp_ptr->height = -bmp_ptr->height;
             bmp_ptr->imgTB_flag = true;
           }