Fix a couple of divide by zero crashes in PNG/TIFF predictors.

core/src/fxcodec/codec/fx_codec_flate.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../fx_zlib.h"
 #include "../../../include/fxcodec/fx_codec.h"
 #include "codec_int.h"
 extern "C"
@@ skipping 215 matching lines @@
     }
     if (pb <= pc) {
         return (FX_BYTE)b;
     }
     return (FX_BYTE)c;
 }
 static void PNG_PredictorEncode(FX_LPBYTE& data_buf, FX_DWORD& data_size, int predictor, int Colors, int BitsPerComponent, int Columns)
 {
     int BytesPerPixel = (Colors * BitsPerComponent + 7) / 8;
     int row_size = (Colors * BitsPerComponent * Columns + 7) / 8;
+    if (row_size == 0)

[Tom Sepez, 2015/05/04 15:23:12]

what happens after we take this path?  Do we continue with the decode using
uninitialized memory?  My concern is that this might disclose some memory
contents.  Maybe we need a bool return value for errors.

[Lei Zhang, 2015/05/04 23:19:36]

Done. I forgot that many parameters passed by reference are actually in-out
params. Best to just bail out on error.

+        return;
     int row_count = (data_size + row_size - 1) / row_size;
     int last_row_size = data_size % row_size;
     FX_LPBYTE dest_buf = FX_Alloc( FX_BYTE, (row_size + 1) * row_count);
     if (dest_buf == NULL) {
         return;
     }
     int byte_cnt = 0;
     FX_LPBYTE pSrcData = data_buf;
     FX_LPBYTE pDestData = dest_buf;
     for (int row = 0; row < row_count; row++) {
@@ skipping 305 matching lines @@
     } else {
         for (int i = BytesPerPixel; i < row_size; i ++) {
             dest_buf[i] += dest_buf[i - BytesPerPixel];
         }
     }
 }
 static void TIFF_Predictor(FX_LPBYTE& data_buf, FX_DWORD& data_size,
                            int Colors, int BitsPerComponent, int Columns)
 {
     int row_size = (Colors * BitsPerComponent * Columns + 7) / 8;
+    if (row_size == 0)
+        return;
     int row_count = (data_size + row_size - 1) / row_size;
     int last_row_size = data_size % row_size;
     for (int row = 0; row < row_count; row ++) {
         FX_LPBYTE scan_line = data_buf + row * row_size;
         if ((row + 1) * row_size > (int)data_size) {
             row_size = last_row_size;
         }
         TIFF_PredictLine(scan_line, row_size, BitsPerComponent, Colors, Columns);
     }
 }
@@ skipping 357 matching lines @@
     dest_size = src_size + src_size / 1000 + 12;
     dest_buf = FX_Alloc( FX_BYTE, dest_size);
     if (dest_buf == NULL) {
         return FALSE;
     }
     unsigned long temp_size = dest_size;
     FPDFAPI_FlateCompress(dest_buf, &temp_size, src_buf, src_size);
     dest_size = (FX_DWORD)temp_size;
     return TRUE;
 }