Fix regression in JBIG2 decoding from commit ce37d73.

core/src/fxcodec/jbig2/JBig2_SddProc.cpp

 // Copyright 2015 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "JBig2_SddProc.h"
 
 #include "../../../../third_party/base/nonstd_unique_ptr.h"
 #include "../../../include/fxcrt/fx_basic.h"
@@ skipping 13 matching lines @@
   FX_DWORD HCHEIGHT, NSYMSDECODED;
   int32_t HCDH;
   FX_DWORD SYMWIDTH, TOTWIDTH;
   int32_t DW;
   CJBig2_Image* BS;
   FX_DWORD I, J, REFAGGNINST;
   FX_BOOL* EXFLAGS;
   FX_DWORD EXINDEX;
   FX_BOOL CUREXFLAG;
   FX_DWORD EXRUNLENGTH;
-  int32_t nVal;
   FX_DWORD nTmp;
   FX_DWORD SBNUMSYMS;
   uint8_t SBSYMCODELEN;
   int32_t RDXI, RDYI;
   CJBig2_Image** SBSYMS;
   nonstd::unique_ptr<CJBig2_ArithIaidDecoder> IAID;
   nonstd::unique_ptr<CJBig2_SymbolDict> pDict;
   nonstd::unique_ptr<CJBig2_ArithIntDecoder> IADH(new CJBig2_ArithIntDecoder);
   nonstd::unique_ptr<CJBig2_ArithIntDecoder> IADW(new CJBig2_ArithIntDecoder);
   nonstd::unique_ptr<CJBig2_ArithIntDecoder> IAAI(new CJBig2_ArithIntDecoder);
@@ skipping 12 matching lines @@
     nTmp++;
   }
   IAID.reset(new CJBig2_ArithIaidDecoder((uint8_t)nTmp));
   SDNEWSYMS = FX_Alloc(CJBig2_Image*, SDNUMNEWSYMS);
   FXSYS_memset(SDNEWSYMS, 0, SDNUMNEWSYMS * sizeof(CJBig2_Image*));
 
   HCHEIGHT = 0;
   NSYMSDECODED = 0;
   while (NSYMSDECODED < SDNUMNEWSYMS) {
     BS = nullptr;
-    if (!IADH->decode(pArithDecoder, &HCDH)) {
-      goto failed;
-    }
+    IADH->decode(pArithDecoder, &HCDH);
     HCHEIGHT = HCHEIGHT + HCDH;
     if ((int)HCHEIGHT < 0 || (int)HCHEIGHT > JBIG2_MAX_IMAGE_SIZE) {
       goto failed;
     }
     SYMWIDTH = 0;
     TOTWIDTH = 0;
     for (;;) {
-      nVal = IADW->decode(pArithDecoder, &DW);
-      if (nVal == JBIG2_OOB) {
+      if (!IADW->decode(pArithDecoder, &DW))
         break;
-      } else if (nVal != 0) {
+
+      if (NSYMSDECODED >= SDNUMNEWSYMS)
         goto failed;
-      } else {
-        if (NSYMSDECODED >= SDNUMNEWSYMS) {
-          goto failed;
-        }
-        SYMWIDTH = SYMWIDTH + DW;
-        if ((int)SYMWIDTH < 0 || (int)SYMWIDTH > JBIG2_MAX_IMAGE_SIZE) {
-          goto failed;
-        } else if (HCHEIGHT == 0 || SYMWIDTH == 0) {
-          TOTWIDTH = TOTWIDTH + SYMWIDTH;
-          SDNEWSYMS[NSYMSDECODED] = nullptr;
-          NSYMSDECODED = NSYMSDECODED + 1;
-          continue;
-        }
+
+      SYMWIDTH = SYMWIDTH + DW;
+      if ((int)SYMWIDTH < 0 || (int)SYMWIDTH > JBIG2_MAX_IMAGE_SIZE)
+        goto failed;
+
+      if (HCHEIGHT == 0 || SYMWIDTH == 0) {
         TOTWIDTH = TOTWIDTH + SYMWIDTH;
+        SDNEWSYMS[NSYMSDECODED] = nullptr;
+        NSYMSDECODED = NSYMSDECODED + 1;
+        continue;
       }
+      TOTWIDTH = TOTWIDTH + SYMWIDTH;
       if (SDREFAGG == 0) {
         nonstd::unique_ptr<CJBig2_GRDProc> pGRD(new CJBig2_GRDProc());
         pGRD->MMR = 0;
         pGRD->GBW = SYMWIDTH;
         pGRD->GBH = HCHEIGHT;
         pGRD->GBTEMPLATE = SDTEMPLATE;
         pGRD->TPGDON = 0;
         pGRD->USESKIP = 0;
         pGRD->GBAT[0] = SDAT[0];
         pGRD->GBAT[1] = SDAT[1];
         pGRD->GBAT[2] = SDAT[2];
         pGRD->GBAT[3] = SDAT[3];
         pGRD->GBAT[4] = SDAT[4];
         pGRD->GBAT[5] = SDAT[5];
         pGRD->GBAT[6] = SDAT[6];
         pGRD->GBAT[7] = SDAT[7];
         BS = pGRD->decode_Arith(pArithDecoder, gbContext);
         if (!BS) {
           goto failed;
         }
       } else {
-        if (!IAAI->decode(pArithDecoder, (int*)&REFAGGNINST)) {
-          goto failed;
-        }
+        IAAI->decode(pArithDecoder, (int*)&REFAGGNINST);
         if (REFAGGNINST > 1) {
           nonstd::unique_ptr<CJBig2_TRDProc> pDecoder(new CJBig2_TRDProc());
           pDecoder->SBHUFF = SDHUFF;
           pDecoder->SBREFINE = 1;
           pDecoder->SBW = SYMWIDTH;
           pDecoder->SBH = HCHEIGHT;
           pDecoder->SBNUMINSTANCES = REFAGGNINST;
           pDecoder->SBSTRIPS = 1;
           pDecoder->SBNUMSYMS = SDNUMINSYMS + NSYMSDECODED;
           SBNUMSYMS = pDecoder->SBNUMSYMS;
@@ skipping 72 matching lines @@
           BS = pDecoder->decode_Arith(pArithDecoder, grContext, &ids);
           if (!BS) {
             FX_Free(SBSYMS);
             goto failed;
           }
           FX_Free(SBSYMS);
         } else if (REFAGGNINST == 1) {
           SBNUMSYMS = SDNUMINSYMS + NSYMSDECODED;
           FX_DWORD IDI;
           IAID->decode(pArithDecoder, &IDI);
-          if (!IARDX->decode(pArithDecoder, &RDXI) ||
-              !IARDY->decode(pArithDecoder, &RDYI)) {
-            goto failed;
-          }
+          IARDX->decode(pArithDecoder, &RDXI);
+          IARDY->decode(pArithDecoder, &RDYI);
           if (IDI >= SBNUMSYMS) {
             goto failed;
           }
           SBSYMS = FX_Alloc(CJBig2_Image*, SBNUMSYMS);
           JBIG2_memcpy(SBSYMS, SDINSYMS, SDNUMINSYMS * sizeof(CJBig2_Image*));
           JBIG2_memcpy(SBSYMS + SDNUMINSYMS, SDNEWSYMS,
                        NSYMSDECODED * sizeof(CJBig2_Image*));
           if (!SBSYMS[IDI]) {
             FX_Free(SBSYMS);
             goto failed;
@@ skipping 20 matching lines @@
       }
       SDNEWSYMS[NSYMSDECODED] = BS;
       BS = nullptr;
       NSYMSDECODED = NSYMSDECODED + 1;
     }
   }
   EXINDEX = 0;
   CUREXFLAG = 0;
   EXFLAGS = FX_Alloc(FX_BOOL, SDNUMINSYMS + SDNUMNEWSYMS);
   while (EXINDEX < SDNUMINSYMS + SDNUMNEWSYMS) {
-    if (!IAEX->decode(pArithDecoder, (int*)&EXRUNLENGTH)) {
-      FX_Free(EXFLAGS);
-      goto failed;
-    }
+    IAEX->decode(pArithDecoder, (int*)&EXRUNLENGTH);
     if (EXINDEX + EXRUNLENGTH > SDNUMINSYMS + SDNUMNEWSYMS) {
       FX_Free(EXFLAGS);
       goto failed;
     }
     if (EXRUNLENGTH != 0) {
       for (I = EXINDEX; I < EXINDEX + EXRUNLENGTH; I++) {
         EXFLAGS[I] = CUREXFLAG;
       }
     }
     EXINDEX = EXINDEX + EXRUNLENGTH;
@@ skipping 369 matching lines @@
 failed:
   for (I = 0; I < NSYMSDECODED; I++) {
     delete SDNEWSYMS[I];
   }
   FX_Free(SDNEWSYMS);
   if (SDREFAGG == 0) {
     FX_Free(SDNEWSYMWIDTHS);
   }
   return nullptr;
 }