More code hardening

Author: flanglet

src/bitstream/DefaultInputBitStream.cpp

@@ -79,13 +79,14 @@ uint DefaultInputBitStream::readBits(byte bits[], uint count)
             remaining -= (availBytes << 3);
             _position = _maxPosition + 1;
 
-            if (readFromInputStream(_bufferSize) < int(_bufferSize))
-                break;
-
+            const int read = readFromInputStream(_bufferSize);
             availBytes = uint(_maxPosition + 1 - _position);
+
+            if (read < int(_bufferSize))
+                break;
         }
 
-        const uint r = (remaining >> 6) << 3;
+        const uint r = min((remaining >> 6) << 3, availBytes);
 
         if (r > 0) {
             memcpy(&bits[start], &_buffer[_position], r);

src/bitstream/DefaultOutputBitStream.hpp

@@ -153,8 +153,8 @@ namespace kanzi
        // Round down to byte alignment
        const uint a = _availBits - (_availBits & 7);
 
-       for (uint i = 56; i >= a; i -= 8) {
-          _buffer[_position++] = byte(_current >> i);
+       for (int i = 56; i >= int(a); i -= 8) {
+          _buffer[_position++] = byte(_current >> uint(i));
 
           if (_position >= _bufferSize)
              flush();
@@ -170,4 +170,3 @@ namespace kanzi
 
 }
 #endif
-

src/entropy/ANSRangeDecoder.cpp

@@ -220,7 +220,7 @@ bool ANSRangeDecoder::decodeChunk(byte block[], uint count)
     // Read chunk size
     const uint sz = uint(EntropyUtils::readVarInt(_bitstream));
 
-    if (sz >= MAX_CHUNK_SIZE)
+    if ((sz >= MAX_CHUNK_SIZE) || (sz > _bufferSize - 2))
        return false;
 
     // Read initial ANS states

src/entropy/HuffmanDecoder.cpp

@@ -212,6 +212,12 @@ bool HuffmanDecoder::decodeChunk(byte block[], uint count)
     if ((szBits0 < 0) || (szBits1 < 0) || (szBits2 < 0) || (szBits3 < 0))
         return false;
 
+    // Each of the 4 streams is stored in one quarter of _buffer.
+    const int maxFragBits = int((_bufferSize >> 2) << 3);
+
+    if ((szBits0 > maxFragBits) || (szBits1 > maxFragBits) || (szBits2 > maxFragBits) || (szBits3 > maxFragBits))
+        return false;
+
     memset(_buffer, 0, _bufferSize);
 
     int idx0 = 0 * (_bufferSize / 4);