Fix a NULL pointer crash in the CJBig2_Image copy constructor.

core/src/fxcodec/jbig2/JBig2_SddProc.cpp

 // Copyright 2015 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "JBig2_SddProc.h"
 
 #include "JBig2_ArithIntDecoder.h"
 #include "JBig2_GrdProc.h"
@@ skipping 248 matching lines @@
       }
     }
     EXINDEX = EXINDEX + EXRUNLENGTH;
     CUREXFLAG = !CUREXFLAG;
   }
   pDict.reset(new CJBig2_SymbolDict);
   I = J = 0;
   for (I = 0; I < SDNUMINSYMS + SDNUMNEWSYMS; I++) {
     if (EXFLAGS[I] && J < SDNUMEXSYMS) {
       if (I < SDNUMINSYMS) {
-        pDict->AddImage(new CJBig2_Image(*SDINSYMS[I]));
+        pDict->AddImage(SDINSYMS[I] ? new CJBig2_Image(*SDINSYMS[I]) : nullptr);

[Lei Zhang, 2015/11/24 18:22:36]

These are consistent with the only other copy ctor usage at
core/src/fxcodec/jbig2/JBig2_SymbolDict.cpp:23.

       } else {
         pDict->AddImage(SDNEWSYMS[I - SDNUMINSYMS]);
       }
       ++J;
     } else if (!EXFLAGS[I] && I >= SDNUMINSYMS) {
       delete SDNEWSYMS[I - SDNUMINSYMS];
     }
   }
   FX_Free(EXFLAGS);
   FX_Free(SDNEWSYMS);
@@ skipping 317 matching lines @@
         EXFLAGS[I] = CUREXFLAG;
       }
     }
     EXINDEX = EXINDEX + EXRUNLENGTH;
     CUREXFLAG = !CUREXFLAG;
   }
   I = J = 0;
   for (I = 0; I < SDNUMINSYMS + SDNUMNEWSYMS; I++) {
     if (EXFLAGS[I] && J < SDNUMEXSYMS) {
       if (I < SDNUMINSYMS) {
-        pDict->AddImage(new CJBig2_Image(*SDINSYMS[I]));
+        pDict->AddImage(SDINSYMS[I] ? new CJBig2_Image(*SDINSYMS[I]) : nullptr);
       } else {
         pDict->AddImage(SDNEWSYMS[I - SDNUMINSYMS]);
       }
       ++J;
     } else if (!EXFLAGS[I] && I >= SDNUMINSYMS) {
       delete SDNEWSYMS[I - SDNUMINSYMS];
     }
   }
   FX_Free(EXFLAGS);
   FX_Free(SDNEWSYMS);
   if (SDREFAGG == 0) {
     FX_Free(SDNEWSYMWIDTHS);
   }
   return pDict.release();
 failed:
   for (I = 0; I < NSYMSDECODED; I++) {
     delete SDNEWSYMS[I];
   }
   FX_Free(SDNEWSYMS);
   if (SDREFAGG == 0) {
     FX_Free(SDNEWSYMWIDTHS);
   }
   return nullptr;
 }