[poppler] poppler/SplashOutputDev.cc

[GitLab Mirror]

 poppler/SplashOutputDev.cc |   18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

New commits:
commit cf25cd0c4893b62a9993034079a6c89c6ca370ee
Author: Albert Astals Cid <aacid at kde.org>
Date:   Thu Sep 20 23:17:06 2018 +0200

    SplashOutputDev::drawSoftMaskedImage: gmallocn -> gmallocn_checkoverflow
    
    oss-fuzz/10298

diff --git a/poppler/SplashOutputDev.cc b/poppler/SplashOutputDev.cc
index a8e31fff..371fc976 100644
--- a/poppler/SplashOutputDev.cc
+++ b/poppler/SplashOutputDev.cc
@@ -4069,14 +4069,16 @@ void SplashOutputDev::drawSoftMaskedImage(GfxState *state, Object *ref,
       }
       break;
     case splashModeXBGR8:
-      imgData.lookup = (SplashColorPtr)gmallocn(n, 4);
-      for (i = 0; i < n; ++i) {
-	pix = (Guchar)i;
-	colorMap->getRGB(&pix, &rgb);
-	imgData.lookup[4*i] = colToByte(rgb.r);
-	imgData.lookup[4*i+1] = colToByte(rgb.g);
-	imgData.lookup[4*i+2] = colToByte(rgb.b);
-	imgData.lookup[4*i+3] = 255;
+      imgData.lookup = (SplashColorPtr)gmallocn_checkoverflow(n, 4);
+      if (imgData.lookup) {
+	for (i = 0; i < n; ++i) {
+	  pix = (Guchar)i;
+	  colorMap->getRGB(&pix, &rgb);
+	  imgData.lookup[4*i] = colToByte(rgb.r);
+	  imgData.lookup[4*i+1] = colToByte(rgb.g);
+	  imgData.lookup[4*i+2] = colToByte(rgb.b);
+	  imgData.lookup[4*i+3] = 255;
+	}
       }
       break;
 #ifdef SPLASH_CMYK