[poppler] poppler/SplashOutputDev.cc

[GitLab Mirror]

 poppler/SplashOutputDev.cc |   20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

New commits:
commit 22ea442de8776e7e6fa78062cb8bb224b98e736f
Author: Albert Astals Cid <aacid at kde.org>
Date:   Thu Sep 20 23:23:56 2018 +0200

    SplashOutputDev::drawImage: gmallocn -> checkoverflow
    
    oss-fuzz/10194
    
    And also add a likely for the previous change in the file

diff --git a/poppler/SplashOutputDev.cc b/poppler/SplashOutputDev.cc
index 371fc976..6faa7477 100644
--- a/poppler/SplashOutputDev.cc
+++ b/poppler/SplashOutputDev.cc
@@ -3553,14 +3553,16 @@ void SplashOutputDev::drawImage(GfxState *state, Object *ref, Stream *str,
       }
       break;
     case splashModeXBGR8:
-      imgData.lookup = (SplashColorPtr)gmallocn(n, 4);
-      for (i = 0; i < n; ++i) {
-	pix = (Guchar)i;
-	colorMap->getRGB(&pix, &rgb);
-	imgData.lookup[4*i] = colToByte(rgb.r);
-	imgData.lookup[4*i+1] = colToByte(rgb.g);
-	imgData.lookup[4*i+2] = colToByte(rgb.b);
-	imgData.lookup[4*i+3] = 255;
+      imgData.lookup = (SplashColorPtr)gmallocn_checkoverflow(n, 4);
+      if (likely(imgData.lookup != nullptr)) {
+	for (i = 0; i < n; ++i) {
+	  pix = (Guchar)i;
+	  colorMap->getRGB(&pix, &rgb);
+	  imgData.lookup[4*i] = colToByte(rgb.r);
+	  imgData.lookup[4*i+1] = colToByte(rgb.g);
+	  imgData.lookup[4*i+2] = colToByte(rgb.b);
+	  imgData.lookup[4*i+3] = 255;
+	}
       }
       break;
 #ifdef SPLASH_CMYK
@@ -4070,7 +4072,7 @@ void SplashOutputDev::drawSoftMaskedImage(GfxState *state, Object *ref,
       break;
     case splashModeXBGR8:
       imgData.lookup = (SplashColorPtr)gmallocn_checkoverflow(n, 4);
-      if (imgData.lookup) {
+      if (likely(imgData.lookup != nullptr)) {
 	for (i = 0; i < n; ++i) {
 	  pix = (Guchar)i;
 	  colorMap->getRGB(&pix, &rgb);