Clear decoders after the image decoder in the /Filter array

core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "render_int.h"
 
 #include <vector>
 
@@ skipping 1064 matching lines @@
   }
 }
 uint8_t* CPDF_DIBSource::GetBuffer() const {
   if (m_pCachedBitmap) {
     return m_pCachedBitmap->GetBuffer();
   }
   return NULL;
 }
 const uint8_t* CPDF_DIBSource::GetScanline(int line) const {
   if (m_bpc == 0) {
-    return NULL;
+    return nullptr;
   }
   FX_SAFE_DWORD src_pitch = CalculatePitch8(m_bpc, m_nComponents, m_Width);
   if (!src_pitch.IsValid())
-    return NULL;
+    return nullptr;
   FX_DWORD src_pitch_value = src_pitch.ValueOrDie();
-  const uint8_t* pSrcLine = NULL;
-  if (m_pCachedBitmap) {
+  const uint8_t* pSrcLine = nullptr;
+  if (m_pCachedBitmap && src_pitch_value <= m_pCachedBitmap->GetPitch()) {

[jun_fang, 2015/11/12 05:41:07]

src_pitch_value should equal m_pCachedBitmap->GetPitch().

[Oliver Chang, 2015/11/12 18:39:45]

This broke some things, as DIBitmap calculates the pitch using:

pitch = (width * (format & 0xff) + 31) / 32 * 4; // Like in CalculatePitch32,
which is aligned to 4 bytes.

While src_pitch is calculated using CalculatePitch8. (We'll very likely want to
cleanup the corresponding arithmetic in DIBitmap).

I'm going to keep this as "<=" to prevent future overflows for now.

     if (line >= m_pCachedBitmap->GetHeight()) {
       line = m_pCachedBitmap->GetHeight() - 1;
     }
     pSrcLine = m_pCachedBitmap->GetScanline(line);
   } else if (m_pDecoder) {
     pSrcLine = m_pDecoder->GetScanline(line);
   } else {
     if (m_pStreamAcc->GetSize() >= (line + 1) * src_pitch_value) {
       pSrcLine = m_pStreamAcc->GetData() + line * src_pitch_value;
     }
   }
-  if (pSrcLine == NULL) {
+  if (!pSrcLine) {
     uint8_t* pLineBuf = m_pMaskedLine ? m_pMaskedLine : m_pLineBuf;
     FXSYS_memset(pLineBuf, 0xFF, m_Pitch);
     return pLineBuf;
   }
   if (m_bpc * m_nComponents == 1) {
     if (m_bImageMask && m_bDefaultDecode) {
       for (FX_DWORD i = 0; i < src_pitch_value; i++) {
         m_pLineBuf[i] = ~pSrcLine[i];
       }
     } else if (m_bColorKey) {
@@ skipping 526 matching lines @@
 }
 FX_BOOL CPDF_ImageLoader::Continue(void* LoadHandle, IFX_Pause* pPause) {
   return ((CPDF_ProgressiveImageLoaderHandle*)LoadHandle)->Continue(pPause);
 }
 CPDF_ImageLoader::~CPDF_ImageLoader() {
   if (!m_bCached) {
     delete m_pBitmap;
     delete m_pMask;
   }
 }