Merge to XFA: Change |CCodec_ScanlineDecoder::m_Pitch| to FX_DWORD

core/src/fxcodec/codec/fx_codec.cpp

 
 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/include/fxcodec/fx_codec.h"
 
 #include <cmath>
@@ skipping 11 matching lines @@
       m_pJbig2Module(new CCodec_Jbig2Module),
       m_pIccModule(new CCodec_IccModule),
       m_pFlateModule(new CCodec_FlateModule),
       m_pPngModule(new CCodec_PngModule),
       m_pGifModule(new CCodec_GifModule),
       m_pBmpModule(new CCodec_BmpModule),
       m_pTiffModule(new CCodec_TiffModule) {}
 
 CCodec_ScanlineDecoder::ImageDataCache::ImageDataCache(int width,
                                                        int height,
-                                                       int pitch)
-    : m_Width(width), m_Height(height), m_Pitch(pitch), m_nCachedLines(0) {
-}
+                                                       FX_DWORD pitch)
+    : m_Width(width), m_Height(height), m_Pitch(pitch), m_nCachedLines(0) {}
 
 CCodec_ScanlineDecoder::ImageDataCache::~ImageDataCache() {
 }
 
 bool CCodec_ScanlineDecoder::ImageDataCache::AllocateCache() {
-  if (m_Pitch <= 0 || m_Height < 0)
+  if (m_Pitch == 0 || m_Height < 0)
     return false;
 
   FX_SAFE_SIZE_T size = m_Pitch;
   size *= m_Height;
   if (!size.IsValid())
     return false;
 
   m_Data.reset(FX_TryAlloc(uint8_t, size.ValueOrDie()));
   return IsValid();
 }
 
 void CCodec_ScanlineDecoder::ImageDataCache::AppendLine(const uint8_t* line) {
   // If the callers adds more lines than there is room, fail.
-  if (m_Pitch <= 0 || m_nCachedLines >= m_Height) {
+  if (m_Pitch == 0 || m_nCachedLines >= m_Height) {
     NOTREACHED();
     return;
   }
 
   size_t offset = m_Pitch;
   FXSYS_memcpy(m_Data.get() + offset * m_nCachedLines, line, m_Pitch);
   ++m_nCachedLines;
 }
 
 const uint8_t* CCodec_ScanlineDecoder::ImageDataCache::GetLine(int line) const {
-  if (m_Pitch <= 0 || line < 0 || line >= m_nCachedLines)
+  if (m_Pitch == 0 || line < 0 || line >= m_nCachedLines)
     return nullptr;
 
   size_t offset = m_Pitch;
   return m_Data.get() + offset * line;
 }
 
 CCodec_ScanlineDecoder::CCodec_ScanlineDecoder()
     : m_NextLine(-1), m_pLastScanline(nullptr) {
 }
 
@@ skipping 281 matching lines @@
                                          int nComps,
                                          int bpc) {
   m_pSrcBuf = src_buf;
   m_SrcSize = src_size;
   m_OutputWidth = m_OrigWidth = width;
   m_OutputHeight = m_OrigHeight = height;
   m_nComps = nComps;
   m_bpc = bpc;
   m_bColorTransformed = FALSE;
   m_DownScale = 1;
-  m_Pitch = (width * nComps * bpc + 31) / 32 * 4;
-  m_dwLineBytes = (width * nComps * bpc + 7) / 8;
+  // Aligning the pitch to 4 bytes requires an integer overflow check.
+  FX_SAFE_DWORD pitch = width;
+  pitch *= nComps;
+  pitch *= bpc;
+  pitch += 31;
+  pitch /= 32;
+  pitch *= 4;
+  if (!pitch.IsValid()) {
+    return FALSE;
+  }
+  m_Pitch = pitch.ValueOrDie();
+  // Overflow should already have been checked before this is called.
+  m_dwLineBytes = (static_cast<FX_DWORD>(width) * nComps * bpc + 7) / 8;
   m_pScanline = FX_Alloc(uint8_t, m_Pitch);
   return CheckDestSize();
 }
 FX_BOOL CCodec_RLScanlineDecoder::v_Rewind() {
   FXSYS_memset(m_pScanline, 0, m_Pitch);
   m_SrcOffset = 0;
   m_bEOD = FALSE;
   m_Operator = 0;
   return TRUE;
 }
@@ skipping 86 matching lines @@
     int nComps,
     int bpc) {
   CCodec_RLScanlineDecoder* pRLScanlineDecoder = new CCodec_RLScanlineDecoder;
   if (!pRLScanlineDecoder->Create(src_buf, src_size, width, height, nComps,
                                   bpc)) {
     delete pRLScanlineDecoder;
     return NULL;
   }
   return pRLScanlineDecoder;
 }