CVS commit by mueller: the "unbreak integer overflow checks". *sigh*, never trust a patch from suse. M +6 -6 Catalog.cc 1.7 M +7 -6 XRef.cc 1.7 --- kdegraphics/kpdf/xpdf/Catalog.cc #1.6:1.7 @@ -13,4 +13,5 @@ #endif +#include #include #include "gmem.h" @@ -65,8 +66,7 @@ Catalog::Catalog(XRef *xrefA) { pagesSize = numPages0 = (int)obj.getNum(); obj.free(); - // The gcc doesnt optimize this away, so this check is ok, - // even if it looks like a pagesSize != pagesSize check - if (pagesSize*sizeof(Page *)/sizeof(Page *) != (unsigned int)pagesSize || - pagesSize*sizeof(Ref)/sizeof(Ref) != (unsigned int)pagesSize) { + if ((pagesSize >= INT_MAX / (signed) sizeof(Page *)) || + (pagesSize >= INT_MAX / (signed) sizeof(Ref))) + { error(-1, "Invalid 'pagesSize'"); ok = gFalse; @@ -201,6 +201,6 @@ int Catalog::readPageTree(Dict *pagesDic if (start >= pagesSize) { pagesSize += 32; - if (pagesSize*sizeof(Page *)/sizeof(Page *) != (unsigned int)pagesSize || - pagesSize*sizeof(Ref)/sizeof(Ref) != (unsigned int)pagesSize) { + if (pagesSize >= INT_MAX / (signed) sizeof(Page*) || + pagesSize >= INT_MAX / (signed) sizeof(Ref)) { error(-1, "Invalid 'pagesSize' parameter."); goto err3; --- kdegraphics/kpdf/xpdf/XRef.cc #1.6:1.7 @@ -13,4 +13,5 @@ #endif +#include #include #include @@ -111,5 +112,5 @@ ObjectStream::ObjectStream(XRef *xref, i } - if (nObjects*sizeof(int)/sizeof(int) != (uint)nObjects) { + if (nObjects >= INT_MAX / (signed) sizeof(int)) { error(-1, "Invalid 'nObjects'"); goto err1; @@ -394,5 +395,5 @@ GBool XRef::readXRefTable(Parser *parser goto err1; } - if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != (uint)newSize) { + if (newSize >= INT_MAX / (signed) sizeof(XRefEntry)) { error(-1, "Invalid 'obj' parameters'"); goto err1; @@ -504,5 +505,5 @@ GBool XRef::readXRefStream(Stream *xrefS } if (newSize > size) { - if (newSize * sizeof(XRefEntry)/sizeof(XRefEntry) != (uint)newSize) { + if (newSize >= INT_MAX / (signed) sizeof(XRefEntry)) { error(-1, "Invalid 'size' parameter."); return gFalse; @@ -598,5 +599,5 @@ GBool XRef::readXRefStreamSection(Stream return gFalse; } - if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != (uint)newSize) { + if (newSize >= INT_MAX / (signed) sizeof(XRefEntry)) { error(-1, "Invalid 'size' inside xref table."); return gFalse; @@ -737,5 +738,5 @@ GBool XRef::constructXRef() { return gFalse; } - if (newSize*sizeof(XRefEntry)/sizeof(XRefEntry) != (uint)newSize) { + if (newSize >= INT_MAX / (signed) sizeof(XRefEntry)) { error(-1, "Invalid 'obj' parameters."); return gFalse; @@ -764,5 +765,5 @@ GBool XRef::constructXRef() { if (streamEndsLen == streamEndsSize) { streamEndsSize += 64; - if (streamEndsSize*sizeof(int)/sizeof(int) != (uint)streamEndsSize) { + if (streamEndsSize >= INT_MAX / (signed) sizeof(int)) { error(-1, "Invalid 'endstream' parameter."); return gFalse;