Fix extraction of colour components in CPDF_DIBSource::DownSampleScanline32Bit

core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "render_int.h"
 
 #include <vector>
 
 #include "../fpdf_page/pageint.h"
 #include "core/include/fpdfapi/fpdf_module.h"
 #include "core/include/fpdfapi/fpdf_pageobj.h"
 #include "core/include/fpdfapi/fpdf_render.h"
 #include "core/include/fxcodec/fx_codec.h"
 #include "core/include/fxcrt/fx_safe_types.h"
 #include "core/include/fxge/fx_ge.h"
 #include "third_party/base/nonstd_unique_ptr.h"
 
 namespace {
 
-unsigned int _GetBits8(const uint8_t* pData, int bitpos, int nbits) {
+unsigned int _GetBits8(const uint8_t* pData, size_t bitpos, size_t nbits) {

[Tom Sepez, 2015/11/11 21:09:44]

follow-up: bitpos needs to be an uint64_t.

kMaxImageDimension is 0x01ffff, so the maximum bytes in an image won't fit in a
size_t on 32 bit platforms, so image size is limited only by memory there. Its
conceivable that we might have a 1GB image even on such a platform, so bitpos ==
8G won't fit into a size_t there either.  This needs to percolate down through
all the other arithmetic.  Sigh.

nit: lose the leading _ as it is now namespaced.

[Oliver Chang, 2015/11/11 22:30:59]

Done. will fix up callers in a separate CL.

   unsigned int byte = pData[bitpos / 8];

[Tom Sepez, 2015/11/11 21:09:45]

ASSERT(nbits == 1 || nbits == 2 || nbits == 4 ||  nbits == 8 || nbits == 16);
ASSERT((bitpos & (nbits - 1)) == 0);

[Oliver Chang, 2015/11/11 22:30:59]

Done.

   if (nbits == 8) {
     return byte;
   }
   if (nbits == 4) {
     return (bitpos % 8) ? (byte & 0x0f) : (byte >> 4);
   }
   if (nbits == 2) {
     return (byte >> (6 - bitpos % 8)) & 0x03;

[Tom Sepez, 2015/11/11 21:09:45]

follow-up: There's probably a general form of this that's faster than branching
and handles n == 1, 2, 4 (but keep the n == 8, n==16 cases). 

[Oliver Chang, 2015/11/11 22:30:59]

Acknowledged.

   }
   if (nbits == 1) {
     return (byte >> (7 - bitpos % 8)) & 0x01;
   }
   if (nbits == 16) {
     return byte * 256 + pData[bitpos / 8 + 1];
   }
   return 0;
 }
 
@@ skipping 1382 matching lines @@
                                              int dest_Bpp,
                                              FX_DWORD src_width,
                                              const uint8_t* pSrcLine,
                                              uint8_t* dest_scan,
                                              int dest_width,
                                              FX_BOOL bFlipX,
                                              int clip_left,
                                              int clip_width) const {
   int last_src_x = -1;
   FX_ARGB last_argb = FXARGB_MAKE(0xFF, 0xFF, 0xFF, 0xFF);
-  FX_FLOAT orig_Not8Bpp = (FX_FLOAT)m_bpc * (FX_FLOAT)m_nComponents / 8.0f;
   FX_FLOAT unit_To8Bpc = 255.0f / ((1 << m_bpc) - 1);
   for (int i = 0; i < clip_width; i++) {
     int dest_x = clip_left + i;
     FX_DWORD src_x = (bFlipX ? (dest_width - dest_x - 1) : dest_x) *
                      (int64_t)src_width / dest_width;
     src_x %= src_width;
-    const uint8_t* pSrcPixel = nullptr;
+
+    // No need to check for overflow, as |src_x| is bounded by |src_width| and
+    // DownSampleScanline already checked for overflow with the pitch
+    // calculation.
+    size_t byte_offset = src_x;
+    size_t bit_offset = 0;
     if (m_bpc % 8 == 0) {
-      pSrcPixel = pSrcLine + src_x * orig_Bpp;
+      byte_offset *= orig_Bpp;
     } else {
-      pSrcPixel = pSrcLine + (int)(src_x * orig_Not8Bpp);
+      byte_offset *= m_bpc;

[Tom Sepez, 2015/11/11 21:09:45]

nit: this can probably be an infix expression since we are not using safe types.
 And using byte_offset for the temporary is a little misleading since we want to
create a count of bits, then derive bytes from it.

[Oliver Chang, 2015/11/11 22:30:59]

Done. I initially used a safe size_t, but neglected to make it read a bit nicer
after I changed it back.

+      byte_offset *= m_nComponents;
+      bit_offset = byte_offset % 8;
+      byte_offset /= 8;
     }
+
+    const uint8_t* pSrcPixel = pSrcLine + byte_offset;
     uint8_t* pDestPixel = dest_scan + i * dest_Bpp;
     FX_ARGB argb;
     if (src_x == last_src_x) {
       argb = last_argb;
     } else {
+      CFX_FixedBufGrow<uint8_t, 128> extracted_components(m_nComponents);
+      if (m_bpc % 8 != 0) {
+        for (FX_DWORD j = 0; j < m_nComponents; ++j) {
+          extracted_components[j] =
+              _GetBits8(pSrcPixel, bit_offset + (j * m_bpc), m_bpc) *
+              unit_To8Bpc;
+        }
+        pSrcPixel = extracted_components;
+      }
+

[Tom Sepez, 2015/11/11 21:09:45]

I think there's a problem with {} nesting, I'd expect to see an else branch here
for the n == 8 case.

[Oliver Chang, 2015/11/11 22:30:59]

Acknowledged.

       if (m_pColorSpace) {
-        CFX_FixedBufGrow<uint8_t, 128> temp(orig_Bpp);
         uint8_t color[4];
         const FX_BOOL bTransMask = TransMask();
         if (m_bDefaultDecode) {
-          if (m_bpc < 8) {
-            int src_bit_pos = 0;
-            if (src_x % 2) {
-              src_bit_pos = 4;
-            }
-            for (FX_DWORD j = 0; j < m_nComponents; ++j) {
-              temp[j] = (uint8_t)(_GetBits8(pSrcPixel, src_bit_pos, m_bpc) *
-                                  unit_To8Bpc);
-              src_bit_pos += m_bpc;
-            }
-            m_pColorSpace->TranslateImageLine(color, temp, 1, 0, 0, bTransMask);
-          } else {
-            m_pColorSpace->TranslateImageLine(color, pSrcPixel, 1, 0, 0,
-                                              bTransMask);
-          }
+          m_pColorSpace->TranslateImageLine(color, pSrcPixel, 1, 0, 0,
+                                            bTransMask);
         } else {
           for (FX_DWORD j = 0; j < m_nComponents; ++j) {
+            FX_FLOAT component_value =
+                static_cast<FX_FLOAT>(extracted_components[j]);
             int color_value =
                 (int)((m_pCompData[j].m_DecodeMin +
-                       m_pCompData[j].m_DecodeStep * (FX_FLOAT)pSrcPixel[j]) *
+                       m_pCompData[j].m_DecodeStep * component_value) *
                           255.0f +
                       0.5f);
-            temp[j] =
+            extracted_components[j] =
                 color_value > 255 ? 255 : (color_value < 0 ? 0 : color_value);
           }
-          m_pColorSpace->TranslateImageLine(color, temp, 1, 0, 0, bTransMask);
+          m_pColorSpace->TranslateImageLine(color, extracted_components, 1, 0,
+                                            0, bTransMask);
         }
         argb = FXARGB_MAKE(0xFF, color[2], color[1], color[0]);
       } else {
-        argb = FXARGB_MAKE(0xFf, pSrcPixel[2], pSrcPixel[1], pSrcPixel[0]);
+        argb = FXARGB_MAKE(0xFF, pSrcPixel[2], pSrcPixel[1], pSrcPixel[0]);
       }
       if (m_bColorKey) {
         int alpha = 0xFF;
         if (m_nComponents == 3 && m_bpc == 8) {
           alpha = (pSrcPixel[0] < m_pCompData[0].m_ColorKeyMin ||
                    pSrcPixel[0] > m_pCompData[0].m_ColorKeyMax ||
                    pSrcPixel[1] < m_pCompData[1].m_ColorKeyMin ||
                    pSrcPixel[1] > m_pCompData[1].m_ColorKeyMax ||
                    pSrcPixel[2] < m_pCompData[2].m_ColorKeyMin ||
                    pSrcPixel[2] > m_pCompData[2].m_ColorKeyMax)
@@ skipping 144 matching lines @@
 }
 FX_BOOL CPDF_ImageLoader::Continue(void* LoadHandle, IFX_Pause* pPause) {
   return ((CPDF_ProgressiveImageLoaderHandle*)LoadHandle)->Continue(pPause);
 }
 CPDF_ImageLoader::~CPDF_ImageLoader() {
   if (!m_bCached) {
     delete m_pBitmap;
     delete m_pMask;
   }
 }