Sanitize CJBig2_SymbolDict's memory usage.

core/src/fxcodec/jbig2/JBig2_SddProc.cpp

 // Copyright 2015 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "JBig2_SddProc.h"
 
 #include "../../../../third_party/base/nonstd_unique_ptr.h"
+#include "../../../../third_party/base/stl_util.h"
 #include "../../../include/fxcrt/fx_basic.h"
 #include "JBig2_ArithIntDecoder.h"
 #include "JBig2_GrdProc.h"
 #include "JBig2_GrrdProc.h"
 #include "JBig2_HuffmanDecoder.h"
 #include "JBig2_HuffmanTable.h"
 #include "JBig2_SymbolDict.h"
 #include "JBig2_TrdProc.h"
 
+using pdfium::vector_as_array;
+
 CJBig2_SymbolDict* CJBig2_SDDProc::decode_Arith(
     CJBig2_ArithDecoder* pArithDecoder,
-    JBig2ArithCtx* gbContext,
-    JBig2ArithCtx* grContext) {
+    std::vector<JBig2ArithCtx>* gbContext,
+    std::vector<JBig2ArithCtx>* grContext) {
   CJBig2_Image** SDNEWSYMS;
   FX_DWORD HCHEIGHT, NSYMSDECODED;
   int32_t HCDH;
   FX_DWORD SYMWIDTH, TOTWIDTH;
   int32_t DW;
   CJBig2_Image* BS;
   FX_DWORD I, J, REFAGGNINST;
   FX_BOOL* EXFLAGS;
   FX_DWORD EXINDEX;
   FX_BOOL CUREXFLAG;
@@ skipping 64 matching lines @@
         pGRD->TPGDON = 0;
         pGRD->USESKIP = 0;
         pGRD->GBAT[0] = SDAT[0];
         pGRD->GBAT[1] = SDAT[1];
         pGRD->GBAT[2] = SDAT[2];
         pGRD->GBAT[3] = SDAT[3];
         pGRD->GBAT[4] = SDAT[4];
         pGRD->GBAT[5] = SDAT[5];
         pGRD->GBAT[6] = SDAT[6];
         pGRD->GBAT[7] = SDAT[7];
-        BS = pGRD->decode_Arith(pArithDecoder, gbContext);
+        BS = pGRD->decode_Arith(pArithDecoder, vector_as_array(gbContext));
         if (!BS) {
           goto failed;
         }
       } else {
         IAAI->decode(pArithDecoder, (int*)&REFAGGNINST);
         if (REFAGGNINST > 1) {
           nonstd::unique_ptr<CJBig2_TRDProc> pDecoder(new CJBig2_TRDProc());
           pDecoder->SBHUFF = SDHUFF;
           pDecoder->SBREFINE = 1;
           pDecoder->SBW = SYMWIDTH;
@@ skipping 67 matching lines @@
           ids.IADT = IADT.get();
           ids.IAFS = IAFS.get();
           ids.IADS = IADS.get();
           ids.IAIT = IAIT.get();
           ids.IARI = IARI.get();
           ids.IARDW = IARDW.get();
           ids.IARDH = IARDH.get();
           ids.IARDX = IARDX.get();
           ids.IARDY = IARDY.get();
           ids.IAID = IAID.get();
-          BS = pDecoder->decode_Arith(pArithDecoder, grContext, &ids);
+          BS = pDecoder->decode_Arith(pArithDecoder, vector_as_array(grContext),
+                                      &ids);
           if (!BS) {
             FX_Free(SBSYMS);
             goto failed;
           }
           FX_Free(SBSYMS);
         } else if (REFAGGNINST == 1) {
           SBNUMSYMS = SDNUMINSYMS + NSYMSDECODED;
           FX_DWORD IDI;
           IAID->decode(pArithDecoder, &IDI);
           IARDX->decode(pArithDecoder, &RDXI);
@@ skipping 14 matching lines @@
           pGRRD->GRH = HCHEIGHT;
           pGRRD->GRTEMPLATE = SDRTEMPLATE;
           pGRRD->GRREFERENCE = SBSYMS[IDI];
           pGRRD->GRREFERENCEDX = RDXI;
           pGRRD->GRREFERENCEDY = RDYI;
           pGRRD->TPGRON = 0;
           pGRRD->GRAT[0] = SDRAT[0];
           pGRRD->GRAT[1] = SDRAT[1];
           pGRRD->GRAT[2] = SDRAT[2];
           pGRRD->GRAT[3] = SDRAT[3];
-          BS = pGRRD->decode(pArithDecoder, grContext);
+          BS = pGRRD->decode(pArithDecoder, vector_as_array(grContext));
           if (!BS) {
             FX_Free(SBSYMS);
             goto failed;
           }
           FX_Free(SBSYMS);
         }
       }
       SDNEWSYMS[NSYMSDECODED] = BS;
       BS = nullptr;
       NSYMSDECODED = NSYMSDECODED + 1;
@@ skipping 37 matching lines @@
   for (I = 0; I < NSYMSDECODED; I++) {
     if (SDNEWSYMS[I]) {
       delete SDNEWSYMS[I];
       SDNEWSYMS[I] = nullptr;
     }
   }
   FX_Free(SDNEWSYMS);
   return nullptr;
 }
 
-CJBig2_SymbolDict* CJBig2_SDDProc::decode_Huffman(CJBig2_BitStream* pStream,
-                                                  JBig2ArithCtx* gbContext,
-                                                  JBig2ArithCtx* grContext,
-                                                  IFX_Pause* pPause) {
+CJBig2_SymbolDict* CJBig2_SDDProc::decode_Huffman(
+    CJBig2_BitStream* pStream,
+    std::vector<JBig2ArithCtx>* gbContext,
+    std::vector<JBig2ArithCtx>* grContext,
+    IFX_Pause* pPause) {
   CJBig2_Image** SDNEWSYMS;
   FX_DWORD* SDNEWSYMWIDTHS;
   FX_DWORD HCHEIGHT, NSYMSDECODED;
   int32_t HCDH;
   FX_DWORD SYMWIDTH, TOTWIDTH, HCFIRSTSYM;
   int32_t DW;
   CJBig2_Image* BS, *BHC;
   FX_DWORD I, J, REFAGGNINST;
   FX_BOOL* EXFLAGS;
   FX_DWORD EXINDEX;
@@ skipping 131 matching lines @@
           pDecoder->SBHUFFRDW = SBHUFFRDW.get();
           pDecoder->SBHUFFRDH = SBHUFFRDH.get();
           pDecoder->SBHUFFRDX = SBHUFFRDX.get();
           pDecoder->SBHUFFRDY = SBHUFFRDY.get();
           pDecoder->SBHUFFRSIZE = SBHUFFRSIZE.get();
           pDecoder->SBRTEMPLATE = SDRTEMPLATE;
           pDecoder->SBRAT[0] = SDRAT[0];
           pDecoder->SBRAT[1] = SDRAT[1];
           pDecoder->SBRAT[2] = SDRAT[2];
           pDecoder->SBRAT[3] = SDRAT[3];
-          BS = pDecoder->decode_Huffman(pStream, grContext);
+          BS = pDecoder->decode_Huffman(pStream, vector_as_array(grContext));
           if (!BS) {
             FX_Free(SBSYMCODES);
             FX_Free(SBSYMS);
             goto failed;
           }
           FX_Free(SBSYMCODES);
           FX_Free(SBSYMS);
         } else if (REFAGGNINST == 1) {
           SBNUMSYMS = SDNUMINSYMS + SDNUMNEWSYMS;
           nTmp = 1;
@@ skipping 51 matching lines @@
           pGRRD->GRREFERENCE = SBSYMS[IDI];
           pGRRD->GRREFERENCEDX = RDXI;
           pGRRD->GRREFERENCEDY = RDYI;
           pGRRD->TPGRON = 0;
           pGRRD->GRAT[0] = SDRAT[0];
           pGRRD->GRAT[1] = SDRAT[1];
           pGRRD->GRAT[2] = SDRAT[2];
           pGRRD->GRAT[3] = SDRAT[3];
           nonstd::unique_ptr<CJBig2_ArithDecoder> pArithDecoder(
               new CJBig2_ArithDecoder(pStream));
-          BS = pGRRD->decode(pArithDecoder.get(), grContext);
+          BS = pGRRD->decode(pArithDecoder.get(), vector_as_array(grContext));
           if (!BS) {
             FX_Free(SBSYMS);
             goto failed;
           }
           pStream->alignByte();
           pStream->offset(2);
           if ((FX_DWORD)nVal != (pStream->getOffset() - nTmp)) {
             delete BS;
             FX_Free(SBSYMS);
             goto failed;
@@ skipping 91 matching lines @@
 failed:
   for (I = 0; I < NSYMSDECODED; I++) {
     delete SDNEWSYMS[I];
   }
   FX_Free(SDNEWSYMS);
   if (SDREFAGG == 0) {
     FX_Free(SDNEWSYMWIDTHS);
   }
   return nullptr;
 }