Merge to XFA: Add safe FX_Alloc2D() macro

core/src/fxcodec/codec/fx_codec_flate.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../../third_party/base/nonstd_unique_ptr.h"
 #include "../../../include/fxcodec/fx_codec.h"
 #include "../../fx_zlib.h"
 #include "codec_int.h"
 
 extern "C"
 {
     static void* my_alloc_func (void* opaque, unsigned int items, unsigned int size)
     {
-        return FX_Alloc(FX_BYTE, items * size);
+        return FX_Alloc2D(FX_BYTE, items, size);
     }
     static void   my_free_func  (void* opaque, void* address)
     {
         FX_Free(address);
     }
     void* FPDFAPI_FlateInit(void* (*alloc_func)(void*, unsigned int, unsigned int),
                             void (*free_func)(void*, void*))
     {
         z_stream* p = (z_stream*)alloc_func(0, 1, sizeof(z_stream));
         if (p == NULL) {
@@ skipping 207 matching lines @@
 static FX_BOOL PNG_PredictorEncode(FX_LPBYTE& data_buf, FX_DWORD& data_size,
                                    int predictor, int Colors,
                                    int BitsPerComponent, int Columns)
 {
     const int BytesPerPixel = (Colors * BitsPerComponent + 7) / 8;
     const int row_size = (Colors * BitsPerComponent * Columns + 7) / 8;
     if (row_size <= 0)
         return FALSE;
     const int row_count = (data_size + row_size - 1) / row_size;
     const int last_row_size = data_size % row_size;
-    FX_LPBYTE dest_buf = FX_Alloc( FX_BYTE, (row_size + 1) * row_count);
-    if (dest_buf == NULL)
-        return FALSE;
+    FX_LPBYTE dest_buf = FX_Alloc2D(FX_BYTE, row_size + 1, row_count);
     int byte_cnt = 0;
     FX_LPBYTE pSrcData = data_buf;
     FX_LPBYTE pDestData = dest_buf;
     for (int row = 0; row < row_count; row++) {
         if (predictor == 10) {
             pDestData[0] = 0;
             int move_size = row_size;
             if (move_size * (row + 1) > (int)data_size) {
                 move_size = data_size - (move_size * row);
             }
@@ skipping 133 matching lines @@
 }
 static FX_BOOL PNG_Predictor(FX_LPBYTE& data_buf, FX_DWORD& data_size,
                              int Colors, int BitsPerComponent, int Columns)
 {
     const int BytesPerPixel = (Colors * BitsPerComponent + 7) / 8;
     const int row_size = (Colors * BitsPerComponent * Columns + 7) / 8;
     if (row_size <= 0)
         return FALSE;
     const int row_count = (data_size + row_size) / (row_size + 1);
     const int last_row_size = data_size % (row_size + 1);
-    FX_LPBYTE dest_buf = FX_Alloc( FX_BYTE, row_size * row_count);
-    if (dest_buf == NULL)
-        return FALSE;
+    FX_LPBYTE dest_buf = FX_Alloc2D(FX_BYTE, row_size, row_count);
     int byte_cnt = 0;
     FX_LPBYTE pSrcData = data_buf;
     FX_LPBYTE pDestData = dest_buf;
     for (int row = 0; row < row_count; row ++) {
         FX_BYTE tag = pSrcData[0];
         byte_cnt++;
         if (tag == 0) {
             int move_size = row_size;
             if ((row + 1) * (move_size + 1) > (int)data_size) {
                 move_size = last_row_size - 1;
@@ skipping 531 matching lines @@
     dest_size = src_size + src_size / 1000 + 12;
     dest_buf = FX_Alloc( FX_BYTE, dest_size);
     if (dest_buf == NULL) {
         return FALSE;
     }
     unsigned long temp_size = dest_size;
     FPDFAPI_FlateCompress(dest_buf, &temp_size, src_buf, src_size);
     dest_size = (FX_DWORD)temp_size;
     return TRUE;
 }