stan/jdk-24
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

7013519: [parfait] Integer overflows in 2D code

Browse Source 
Reviewed-by: prr, valeriep
This commit is contained in:
Andrew Brygin 2011-02-17 12:21:49 +03:00
parent e8b79573d2
commit 0c700cc07d
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
jdk/src/share/native/sun/awt/image/jpeg/imageioJPEG.c
View File

@ -1971,6 +1971,13 @@ Java_com_sun_imageio_plugins_jpeg_JPEGImageReader_readImage
return data->abortFlag; return data->abortFlag;
} }
if (cinfo->output_components <= 0 ||
cinfo->image_width > (0xffffffffu / (unsigned int)cinfo->output_components))
{
JNU_ThrowByName(env, "javax/imageio/IIOException",
"Invalid number of output components");
return data->abortFlag;
}
// Allocate a 1-scanline buffer // Allocate a 1-scanline buffer
scanLinePtr = (JSAMPROW)malloc(cinfo->image_width*cinfo->output_components); scanLinePtr = (JSAMPROW)malloc(cinfo->image_width*cinfo->output_components);

6
jdk/src/share/native/sun/font/layout/SunLayoutEngine.cpp
View File

@ -186,7 +186,11 @@ JNIEXPORT void JNICALL Java_sun_font_SunLayoutEngine_nativeLayout
jchar buffer[256]; jchar buffer[256];
jchar* chars = buffer; jchar* chars = buffer;
if (len > 256) { if (len > 256) {
chars = (jchar*)malloc(len * sizeof(jchar)); size_t size = len * sizeof(jchar);
if (size / sizeof(jchar) != len) {
return;
}
chars = (jchar*)malloc(size);
if (chars == 0) { if (chars == 0) {
return; return;
} }