jbig2dec

Update of /cvsroot/jbig2dec/jbig2dec
In directory sc8-pr-cvs1:/tmp/cvs-serv10898

Modified Files:
	jbig2_segment.c 
Log Message:
Code cleanup: re-order a buffer-size check in the segement header parser to avoid a memory leak on
failure.


Index: jbig2_segment.c
===================================================================
RCS file: /cvsroot/jbig2dec/jbig2dec/jbig2_segment.c,v
retrieving revision 1.19
retrieving revision 1.20
diff -u -r1.19 -r1.20
--- jbig2_segment.c	7 Feb 2003 05:14:09 -0000	1.19
+++ jbig2_segment.c	4 Mar 2003 17:29:24 -0000	1.20
@@ -43,12 +43,12 @@
 					     sizeof(Jbig2Segment));
 
   /* 7.2.2 */
-  result->number = jbig2_get_int32 (buf);
+  result->number = jbig2_get_int32(buf);
 
   /* 7.2.3 */
   result->flags = buf[4];
 
-  /* 7.2.4 */
+  /* 7.2.4 referred-to segments */
   rtscarf = buf[5];
   if ((rtscarf & 0xe0) == 0xe0)
     {
@@ -63,13 +63,23 @@
     }
   result->referred_to_segment_count = referred_to_segment_count;
 
+  /* we now have enough information to compute the full header length */
+  referred_to_segment_size = result->number <= 256 ? 1:
+        result->number <= 65536 ? 2 : 4;  /* 7.2.5 */
+  pa_size = result->flags & 0x40 ? 4 : 1; /* 7.2.6 */
+  if (offset + referred_to_segment_count*referred_to_segment_size + pa_size + 4 > buf_size)
+    {
+      jbig2_error(ctx, JBIG2_SEVERITY_DEBUG, result->number, 
+        "jbig2_parse_segment_header() called with insufficient data", -1);
+      jbig2_free (ctx->allocator, result);
+      return NULL;
+    }
+    
   /* 7.2.5 */
   if (referred_to_segment_count)
     {
       int i;
 
-      referred_to_segment_size = result->number <= 256 ? 1:
-        result->number <= 65536 ? 2 : 4;
       referred_to_segments = jbig2_alloc(ctx->allocator, referred_to_segment_count * referred_to_segment_size);
     
       for (i = 0; i < referred_to_segment_count; i++) {
@@ -90,14 +100,6 @@
     }
   
   /* 7.2.6 */
-  pa_size = result->flags & 0x40 ? 4 : 1;
-
-  if (offset + pa_size + 4 > buf_size)
-    {
-      jbig2_free (ctx->allocator, result);
-      return NULL;
-    }
-  
   if (result->flags & 0x40) {
 	result->page_association = jbig2_get_int32(buf + offset);
 	offset += 4;