Fix regression in CJBig2_TRDProc.
Commit 7695dd0f mistakenly changed a signed integer to unsigned. This is
incorrect because right shifts for negative integers behave differently.
BUG=chromium:859284
Change-Id: Id9c54848b15ace1de080c174f261dd2c064018e0
Reviewed-on: https://pdfium-review.googlesource.com/37230
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
diff --git a/core/fxcodec/jbig2/JBig2_TrdProc.cpp b/core/fxcodec/jbig2/JBig2_TrdProc.cpp
index 4790f66..79b2142 100644
--- a/core/fxcodec/jbig2/JBig2_TrdProc.cpp
+++ b/core/fxcodec/jbig2/JBig2_TrdProc.cpp
@@ -27,11 +27,11 @@
return {result.ValueOrDie()};
}
-Optional<int32_t> CheckTRDReferenceDimension(uint32_t dimension,
- uint32_t divisor,
+Optional<int32_t> CheckTRDReferenceDimension(int32_t dimension,
+ uint32_t shift,
int32_t offset) {
FX_SAFE_INT32 result = offset;
- result += dimension / divisor;
+ result += dimension >> shift;
if (!result.IsValid())
return {};
return {result.ValueOrDie()};
@@ -162,9 +162,9 @@
return nullptr;
Optional<int32_t> GRREFERENCEDX =
- CheckTRDReferenceDimension(RDWI, 4, RDXI);
+ CheckTRDReferenceDimension(RDWI, 2, RDXI);
Optional<int32_t> GRREFERENCEDY =
- CheckTRDReferenceDimension(RDHI, 4, RDYI);
+ CheckTRDReferenceDimension(RDHI, 2, RDYI);
if (!GRREFERENCEDX || !GRREFERENCEDY)
return nullptr;
@@ -342,9 +342,9 @@
return nullptr;
Optional<int32_t> GRREFERENCEDX =
- CheckTRDReferenceDimension(RDWI, 2, RDXI);
+ CheckTRDReferenceDimension(RDWI, 1, RDXI);
Optional<int32_t> GRREFERENCEDY =
- CheckTRDReferenceDimension(RDHI, 2, RDYI);
+ CheckTRDReferenceDimension(RDHI, 1, RDYI);
if (!GRREFERENCEDX || !GRREFERENCEDY)
return nullptr;