Validate the range in CPDF_LabCS::GetDefaultValue().
The min range value should not be greater than the max.
Bug: chromium:1236380
Change-Id: I974b7d71d582f52d042d67c87eb6a6d46437723c
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/83895
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
diff --git a/core/fpdfapi/page/cpdf_colorspace.cpp b/core/fpdfapi/page/cpdf_colorspace.cpp
index b03be13..331b5cb 100644
--- a/core/fpdfapi/page/cpdf_colorspace.cpp
+++ b/core/fpdfapi/page/cpdf_colorspace.cpp
@@ -829,17 +829,22 @@
float* value,
float* min,
float* max) const {
- DCHECK(iComponent < 3);
- if (iComponent == 0) {
- *min = 0.0f;
- *max = 100 * 1.0f;
- *value = 0.0f;
- return;
+ DCHECK_LT(iComponent, 3);
+
+ if (iComponent > 0) {
+ float range_min = m_Ranges[iComponent * 2 - 2];
+ float range_max = m_Ranges[iComponent * 2 - 1];
+ if (range_min <= range_max) {
+ *min = range_min;
+ *max = range_max;
+ *value = pdfium::clamp(0.0f, *min, *max);
+ return;
+ }
}
- *min = m_Ranges[iComponent * 2 - 2];
- *max = m_Ranges[iComponent * 2 - 1];
- *value = pdfium::clamp(0.0f, *min, *max);
+ *min = 0.0f;
+ *max = 100.0f;
+ *value = 0.0f;
}
uint32_t CPDF_LabCS::v_Load(CPDF_Document* pDoc,
