Merge to M44: Fix Heap Overflow in CJBig2_Image::expand

core/src/fxcodec/jbig2/JBig2_Image.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#include "JBig2_Image.h"
+#include <limits.h>
 #include "../../../include/fxcrt/fx_basic.h"
 #include "../../../include/fxcrt/fx_coordinates.h"
-#include <limits.h>
+#include "../../../src/fxcrt/fx_safe_types.h"
+#include "JBig2_Image.h"
+
 CJBig2_Image::CJBig2_Image(FX_INT32 w, FX_INT32 h)
 {
     m_nWidth    = w;
     m_nHeight   = h;
     if (m_nWidth <= 0 || m_nHeight <= 0 || m_nWidth > INT_MAX - 31) {
         m_pData = NULL;
         m_bNeedFree = FALSE;
         return;
     }
     m_nStride  = ((w + 31) >> 5) << 2;
@@ skipping 740 matching lines @@
             pLineDst += pImage->m_nStride;
         }
     }
     return pImage;
 }
 void CJBig2_Image::expand(FX_INT32 h, FX_BOOL v)
 {
     if (!m_pData) {
         return;
     }
-    m_pData = (FX_BYTE*)m_pModule->JBig2_Realloc(m_pData, h * m_nStride);
+    FX_SAFE_DWORD safeMemSize = pdfium::base::checked_cast<FX_DWORD>(h); 
+    safeMemSize *= pdfium::base::checked_cast<FX_DWORD>(m_nStride);
+    if (!safeMemSize.IsValid()) {
+        return;
+    }
+    m_pData = (FX_BYTE*)m_pModule->JBig2_Realloc(m_pData, safeMemSize.ValueOrDie());
     if(h > m_nHeight) {
         JBIG2_memset(m_pData + m_nHeight * m_nStride, v ? 0xff : 0, (h - m_nHeight)*m_nStride);
     }
     m_nHeight = h;
 }
 FX_BOOL CJBig2_Image::composeTo_opt2(CJBig2_Image *pDst, FX_INT32 x, FX_INT32 y, JBig2ComposeOp op)
 {
     FX_INT32 xs0 = 0, ys0  = 0, xs1  = 0, ys1   = 0, xd0    = 0, yd0          = 0, xd1      = 0, 
              yd1 = 0, xx   = 0, yy   = 0, w     = 0, h      = 0, middleDwords = 0, lineLeft = 0;
 
@@ skipping 825 matching lines @@
                     dp[2] = (FX_BYTE)(tmp >> 8);
                     dp[3] = (FX_BYTE)tmp;
                 }
                 lineSrc += m_nStride;
                 lineDst += pDst->m_nStride;
             }
         }
     }
     return 1;
 }