Fixes bug #689870 - add proper big endian number accessors.

Previously only an unsigned accessor was provided and it was being
used to read both signed and unsigned quantities.

7 files changed, 52 insertions, 29 deletions

diff --git a/gs/jbig2dec/jbig2.c b/gs/jbig2dec/jbig2.c
index 71b3b723c..e81d2cd7f 100644
--- a/gs/jbig2dec/jbig2.c
+++ b/gs/jbig2dec/jbig2.c
@@ -160,16 +160,33 @@ jbig2_ctx_new (Jbig2Allocator *allocator,
   return result;
 }
 
+#define get_uint16(bptr)\
+  (((bptr)[0] << 8) | (bptr)[1])
+#define get_int16(bptr)\
+  (((int)get_uint16(bptr) ^ 0x8000) - 0x8000)
+
+int16_t
+jbig2_get_int16(const byte *bptr)
+{	
+    return get_int16(bptr);
+}
+
+uint16_t
+jbig2_get_uint16(const byte *bptr)
+{	
+    return get_uint16(bptr);
+}
+
 int32_t
-jbig2_get_int32 (const byte *buf)
-{
-  return (buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3];
+jbig2_get_int32(const byte *bptr)
+{	
+    return ((int32_t)get_int16(bptr) << 16) | get_uint16(bptr + 2);
 }
 
-int16_t
-jbig2_get_int16 (const byte *buf)
-{
-  return (buf[0] << 8) | buf[1];
+uint32_t
+jbig2_get_uint32(const byte *bptr)
+{	
+    return ((uint32_t)get_uint16(bptr) << 16) | get_uint16(bptr + 2);
 }
 
 
diff --git a/gs/jbig2dec/jbig2_halftone.c b/gs/jbig2dec/jbig2_halftone.c
index dcb53d703..3582b4569 100644
--- a/gs/jbig2dec/jbig2_halftone.c
+++ b/gs/jbig2dec/jbig2_halftone.c
@@ -218,7 +218,7 @@ jbig2_pattern_dictionary(Jbig2Ctx *ctx, Jbig2Segment *segment,
   params.HDTEMPLATE = (flags & 6) >> 1;
   params.HDPW = segment_data[1];
   params.HDPH = segment_data[2];
-  params.GRAYMAX = jbig2_get_int32(segment_data + 3);
+  params.GRAYMAX = jbig2_get_uint32(segment_data + 3);
   offset += 7;
 
   jbig2_error(ctx, JBIG2_SEVERITY_INFO, segment->number,
@@ -320,16 +320,16 @@ jbig2_halftone_region(Jbig2Ctx *ctx, Jbig2Segment *segment, const byte *segment_
 
   /* Figure 43 */
   if (segment->data_length - offset < 16) goto too_short;
-  params.HGW = jbig2_get_int32(segment_data + offset);
-  params.HGH = jbig2_get_int32(segment_data + offset + 4);
+  params.HGW = jbig2_get_uint32(segment_data + offset);
+  params.HGH = jbig2_get_uint32(segment_data + offset + 4);
   params.HGX = jbig2_get_int32(segment_data + offset + 8);
   params.HGY = jbig2_get_int32(segment_data + offset + 12);
   offset += 16;
 
   /* Figure 44 */
   if (segment->data_length - offset < 4) goto too_short;
-  params.HRX = jbig2_get_int16(segment_data + offset);
-  params.HRY = jbig2_get_int16(segment_data + offset + 2);
+  params.HRX = jbig2_get_uint16(segment_data + offset);
+  params.HRY = jbig2_get_uint16(segment_data + offset + 2);
   offset += 4;
 
   jbig2_error(ctx, JBIG2_SEVERITY_INFO, segment->number,
diff --git a/gs/jbig2dec/jbig2_page.c b/gs/jbig2dec/jbig2_page.c
index 03d6d674d..d1da4d70b 100644
--- a/gs/jbig2dec/jbig2_page.c
+++ b/gs/jbig2dec/jbig2_page.c
@@ -105,11 +105,11 @@ jbig2_page_info (Jbig2Ctx *ctx, Jbig2Segment *segment, const uint8_t *segment_da
     }
 
     /* 7.4.8.x */
-    page->width = jbig2_get_int32(segment_data);
-    page->height = jbig2_get_int32(segment_data + 4);
+    page->width = jbig2_get_uint32(segment_data);
+    page->height = jbig2_get_uint32(segment_data + 4);
 
-    page->x_resolution = jbig2_get_int32(segment_data + 8);
-    page->y_resolution = jbig2_get_int32(segment_data + 12);
+    page->x_resolution = jbig2_get_uint32(segment_data + 8);
+    page->y_resolution = jbig2_get_uint32(segment_data + 12);
     page->flags = segment_data[16];
 
     /* 7.4.8.6 */
diff --git a/gs/jbig2dec/jbig2_priv.h b/gs/jbig2dec/jbig2_priv.h
index d5b3bc5e7..8fb7f7790 100644
--- a/gs/jbig2dec/jbig2_priv.h
+++ b/gs/jbig2dec/jbig2_priv.h
@@ -73,9 +73,15 @@ struct _Jbig2Ctx {
   Jbig2Page *pages;
 };
 
+uint32_t
+jbig2_get_uint32(const byte *bptr);
+
 int32_t
 jbig2_get_int32 (const byte *buf);
 
+uint16_t
+jbig2_get_uint16(const byte *bptr);
+
 int16_t
 jbig2_get_int16 (const byte *buf);
 
diff --git a/gs/jbig2dec/jbig2_segment.c b/gs/jbig2dec/jbig2_segment.c
index 8f65917a5..597ee7e01 100644
--- a/gs/jbig2dec/jbig2_segment.c
+++ b/gs/jbig2dec/jbig2_segment.c
@@ -46,7 +46,7 @@ jbig2_parse_segment_header (Jbig2Ctx *ctx, uint8_t *buf, size_t buf_size,
   result = jbig2_new(ctx, Jbig2Segment, 1);
 
   /* 7.2.2 */
-  result->number = jbig2_get_int32(buf);
+  result->number = jbig2_get_uint32(buf);
 
   /* 7.2.3 */
   result->flags = buf[4];
@@ -55,7 +55,7 @@ jbig2_parse_segment_header (Jbig2Ctx *ctx, uint8_t *buf, size_t buf_size,
   rtscarf = buf[5];
   if ((rtscarf & 0xe0) == 0xe0)
     {
-      rtscarf_long = jbig2_get_int32(buf + 5);
+      rtscarf_long = jbig2_get_uint32(buf + 5);
       referred_to_segment_count = rtscarf_long & 0x1fffffff;
       offset = 5 + 4 + (referred_to_segment_count + 1) / 8;
     }
@@ -89,8 +89,8 @@ jbig2_parse_segment_header (Jbig2Ctx *ctx, uint8_t *buf, size_t buf_size,
       for (i = 0; i < referred_to_segment_count; i++) {
         referred_to_segments[i] =
           (referred_to_segment_size == 1) ? buf[offset] :
-          (referred_to_segment_size == 2) ? jbig2_get_int16(buf+offset) :
-            jbig2_get_int32(buf + offset);
+          (referred_to_segment_size == 2) ? jbig2_get_uint16(buf+offset) :
+            jbig2_get_uint32(buf + offset);
         offset += referred_to_segment_size;
         jbig2_error(ctx, JBIG2_SEVERITY_DEBUG, result->number,
             "segment %d refers to segment %d",
@@ -105,7 +105,7 @@ jbig2_parse_segment_header (Jbig2Ctx *ctx, uint8_t *buf, size_t buf_size,
 
   /* 7.2.6 */
   if (result->flags & 0x40) {
-	result->page_association = jbig2_get_int32(buf + offset);
+	result->page_association = jbig2_get_uint32(buf + offset);
 	offset += 4;
   } else {
 	result->page_association = buf[offset++];
@@ -115,7 +115,7 @@ jbig2_parse_segment_header (Jbig2Ctx *ctx, uint8_t *buf, size_t buf_size,
   	result->number, result->page_association);
 
   /* 7.2.7 */
-  result->data_length = jbig2_get_int32(buf + offset);
+  result->data_length = jbig2_get_uint32(buf + offset);
   *p_header_size = offset + 4;
 
   /* no body parsing results yet */
@@ -200,7 +200,7 @@ int jbig2_parse_extension_segment(Jbig2Ctx *ctx, Jbig2Segment *segment,
     uint32_t type;
     bool reserved, dependent, necessary;
 
-    type = jbig2_get_int32(segment_data);
+    type = jbig2_get_uint32(segment_data);
 
     reserved = type & 0x20000000;
     dependent = type & 0x40000000;
diff --git a/gs/jbig2dec/jbig2_symbol_dict.c b/gs/jbig2dec/jbig2_symbol_dict.c
index 6c0efc673..dc3c5a61b 100644
--- a/gs/jbig2dec/jbig2_symbol_dict.c
+++ b/gs/jbig2dec/jbig2_symbol_dict.c
@@ -758,7 +758,7 @@ jbig2_symbol_dictionary(Jbig2Ctx *ctx, Jbig2Segment *segment,
     goto too_short;
 
   /* 7.4.2.1.1 */
-  flags = jbig2_get_int16(segment_data);
+  flags = jbig2_get_uint16(segment_data);
   params.SDHUFF = flags & 1;
   params.SDREFAGG = (flags >> 1) & 1;
   params.SDTEMPLATE = (flags >> 10) & 3;
@@ -889,9 +889,9 @@ jbig2_symbol_dictionary(Jbig2Ctx *ctx, Jbig2Segment *segment,
     goto too_short;
 
   /* 7.4.2.1.4 */
-  params.SDNUMEXSYMS = jbig2_get_int32(segment_data + offset);
+  params.SDNUMEXSYMS = jbig2_get_uint32(segment_data + offset);
   /* 7.4.2.1.5 */
-  params.SDNUMNEWSYMS = jbig2_get_int32(segment_data + offset + 4);
+  params.SDNUMNEWSYMS = jbig2_get_uint32(segment_data + offset + 4);
   offset += 8;
 
   jbig2_error(ctx, JBIG2_SEVERITY_INFO, segment->number,
diff --git a/gs/jbig2dec/jbig2_text.c b/gs/jbig2dec/jbig2_text.c
index d278a4396..0d0385d43 100644
--- a/gs/jbig2dec/jbig2_text.c
+++ b/gs/jbig2dec/jbig2_text.c
@@ -429,7 +429,7 @@ jbig2_text_region(Jbig2Ctx *ctx, Jbig2Segment *segment, const byte *segment_data
     offset += 17;
 
     /* 7.4.3.1.1 */
-    flags = jbig2_get_int16(segment_data + offset);
+    flags = jbig2_get_uint16(segment_data + offset);
     offset += 2;
 
     jbig2_error(ctx, JBIG2_SEVERITY_DEBUG, segment->number,
@@ -456,7 +456,7 @@ jbig2_text_region(Jbig2Ctx *ctx, Jbig2Segment *segment, const byte *segment_data
     if (params.SBHUFF)	/* Huffman coding */
       {
         /* 7.4.3.1.2 */
-        huffman_flags = jbig2_get_int16(segment_data + offset);
+        huffman_flags = jbig2_get_uint16(segment_data + offset);
         offset += 2;
 
         if (huffman_flags & 0x8000)
@@ -480,7 +480,7 @@ jbig2_text_region(Jbig2Ctx *ctx, Jbig2Segment *segment, const byte *segment_data
       }
 
     /* 7.4.3.1.4 */
-    params.SBNUMINSTANCES = jbig2_get_int32(segment_data + offset);
+    params.SBNUMINSTANCES = jbig2_get_uint32(segment_data + offset);
     offset += 4;
 
     if (params.SBHUFF) {