Fix CalculatePitch32() issues.

core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include <vector>
 
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fpdfapi/fpdf_pageobj.h"
@@ skipping 20 matching lines @@
   }
   if (nbits == 1) {
     return (byte >> (7 - bitpos % 8)) & 0x01;
   }
   if (nbits == 16) {
     return byte * 256 + pData[bitpos / 8 + 1];
   }
   return 0;
 }
 
-FX_SAFE_DWORD CalculatePitch8(FX_DWORD bpc,
-                              FX_DWORD components,
-                              int width,
-                              int height) {
+FX_SAFE_DWORD CalculatePitch8(FX_DWORD bpc, FX_DWORD components, int width) {
   FX_SAFE_DWORD pitch = bpc;
   pitch *= components;
   pitch *= width;
   pitch += 7;
   pitch /= 8;
-  pitch *= height;
   return pitch;
 }
 
 FX_SAFE_DWORD CalculatePitch32(int bpp, int width) {
   FX_SAFE_DWORD pitch = bpp;
   pitch *= width;
   pitch += 31;
-  pitch /= 8;
+  pitch /= 32;  // quantized to number of 32-bit words.
+  pitch *= 4;   // and then back to bytes, (not just /8 in one step).
   return pitch;
 }
 
 // Wrapper class to use with nonstd::unique_ptr for CJPX_Decoder.
 class JpxBitMapContext {
  public:
   explicit JpxBitMapContext(ICodec_JpxModule* jpx_module)
       : jpx_module_(jpx_module), decoder_(nullptr) {}
 
   ~JpxBitMapContext() {
@@ skipping 156 matching lines @@
   }
   m_GroupFamily = GroupFamily;
   m_bLoadMask = bLoadMask;
   if (!LoadColorInfo(m_pStream->GetObjNum() != 0 ? NULL : pFormResources,
                      pPageResources)) {
     return FALSE;
   }
   if (m_bDoBpcCheck && (m_bpc == 0 || m_nComponents == 0)) {
     return FALSE;
   }
-  FX_SAFE_DWORD src_pitch =
-      CalculatePitch8(m_bpc, m_nComponents, m_Width, m_Height);
-  if (!src_pitch.IsValid()) {
+  FX_SAFE_DWORD src_size =
+      CalculatePitch8(m_bpc, m_nComponents, m_Width) * m_Height;
+  if (!src_size.IsValid()) {
     return FALSE;
   }
   m_pStreamAcc = new CPDF_StreamAcc;
-  m_pStreamAcc->LoadAllData(pStream, FALSE, src_pitch.ValueOrDie(), TRUE);
+  m_pStreamAcc->LoadAllData(pStream, FALSE, src_size.ValueOrDie(), TRUE);
   if (m_pStreamAcc->GetSize() == 0 || m_pStreamAcc->GetData() == NULL) {
     return FALSE;
   }
   if (!CreateDecoder()) {
     return FALSE;
   }
   if (m_bImageMask) {
     m_bpp = 1;
     m_bpc = 1;
     m_nComponents = 1;
@@ skipping 93 matching lines @@
   }
   m_GroupFamily = GroupFamily;
   m_bLoadMask = bLoadMask;
   if (!LoadColorInfo(m_pStream->GetObjNum() != 0 ? NULL : pFormResources,
                      pPageResources)) {
     return 0;
   }
   if (m_bDoBpcCheck && (m_bpc == 0 || m_nComponents == 0)) {
     return 0;
   }
-  FX_SAFE_DWORD src_pitch =
-      CalculatePitch8(m_bpc, m_nComponents, m_Width, m_Height);
-  if (!src_pitch.IsValid()) {
+  FX_SAFE_DWORD src_size =
+      CalculatePitch8(m_bpc, m_nComponents, m_Width) * m_Height;
+  if (!src_size.IsValid()) {
     return 0;
   }
   m_pStreamAcc = new CPDF_StreamAcc;
-  m_pStreamAcc->LoadAllData(pStream, FALSE, src_pitch.ValueOrDie(), TRUE);
+  m_pStreamAcc->LoadAllData(pStream, FALSE, src_size.ValueOrDie(), TRUE);
   if (m_pStreamAcc->GetSize() == 0 || m_pStreamAcc->GetData() == NULL) {
     return 0;
   }
   int ret = CreateDecoder();
   if (ret != 1) {
     if (!ret) {
       return ret;
     }
     if (!ContinueToLoadMask()) {
       return 0;
@@ skipping 285 matching lines @@
     m_pDecoder = CPDF_ModuleMgr::Get()
                      ->GetCodecModule()
                      ->GetBasicModule()
                      ->CreateRunLengthDecoder(src_data, src_size, m_Width,
                                               m_Height, m_nComponents, m_bpc);
   }
   if (!m_pDecoder)
     return 0;
 
   FX_SAFE_DWORD requested_pitch =
-      CalculatePitch8(m_bpc, m_nComponents, m_Width, 1);
+      CalculatePitch8(m_bpc, m_nComponents, m_Width);
   if (!requested_pitch.IsValid()) {
     return 0;
   }
-  FX_SAFE_DWORD provided_pitch =
-      CalculatePitch8(m_pDecoder->GetBPC(), m_pDecoder->CountComps(),
-                      m_pDecoder->GetWidth(), 1);
+  FX_SAFE_DWORD provided_pitch = CalculatePitch8(
+      m_pDecoder->GetBPC(), m_pDecoder->CountComps(), m_pDecoder->GetWidth());
   if (!provided_pitch.IsValid()) {
     return 0;
   }
   if (provided_pitch.ValueOrDie() < requested_pitch.ValueOrDie()) {
     return 0;
   }
   return 1;
 }
 void CPDF_DIBSource::LoadJpxBitmap() {
   ICodec_JpxModule* pJpxModule = CPDF_ModuleMgr::Get()->GetJpxModule();
@@ skipping 396 matching lines @@
 uint8_t* CPDF_DIBSource::GetBuffer() const {
   if (m_pCachedBitmap) {
     return m_pCachedBitmap->GetBuffer();
   }
   return NULL;
 }
 const uint8_t* CPDF_DIBSource::GetScanline(int line) const {
   if (m_bpc == 0) {
     return NULL;
   }
-  FX_SAFE_DWORD src_pitch = CalculatePitch8(m_bpc, m_nComponents, m_Width, 1);
+  FX_SAFE_DWORD src_pitch = CalculatePitch8(m_bpc, m_nComponents, m_Width);
   if (!src_pitch.IsValid())
     return NULL;
   FX_DWORD src_pitch_value = src_pitch.ValueOrDie();
   const uint8_t* pSrcLine = NULL;
   if (m_pCachedBitmap) {
     if (line >= m_pCachedBitmap->GetHeight()) {
       line = m_pCachedBitmap->GetHeight() - 1;
     }
     pSrcLine = m_pCachedBitmap->GetScanline(line);
   } else if (m_pDecoder) {
@@ skipping 125 matching lines @@
                                         int dest_width,
                                         FX_BOOL bFlipX,
                                         int clip_left,
                                         int clip_width) const {
   if (line < 0 || !dest_scan || dest_bpp <= 0 || dest_width <= 0 ||
       clip_left < 0 || clip_width <= 0) {
     return;
   }
 
   FX_DWORD src_width = m_Width;
-  FX_SAFE_DWORD pitch = CalculatePitch8(m_bpc, m_nComponents, m_Width, 1);
+  FX_SAFE_DWORD pitch = CalculatePitch8(m_bpc, m_nComponents, m_Width);
   if (!pitch.IsValid())
     return;
 
   const uint8_t* pSrcLine = nullptr;
   if (m_pCachedBitmap) {
     pSrcLine = m_pCachedBitmap->GetScanline(line);
   } else if (m_pDecoder) {
     pSrcLine = m_pDecoder->GetScanline(line);
   } else {
     FX_DWORD src_pitch = pitch.ValueOrDie();
@@ skipping 397 matching lines @@
 }
 FX_BOOL CPDF_ImageLoader::Continue(void* LoadHandle, IFX_Pause* pPause) {
   return ((CPDF_ProgressiveImageLoaderHandle*)LoadHandle)->Continue(pPause);
 }
 CPDF_ImageLoader::~CPDF_ImageLoader() {
   if (!m_bCached) {
     delete m_pBitmap;
     delete m_pMask;
   }
 }