Reland "Fix sycc{420,422}_to_rgb issues."

core/fxcodec/codec/fx_codec_jpx_opj.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include <algorithm>
 #include <limits>
 #include <vector>
 
@@ skipping 183 matching lines @@
     ++g;
     ++b;
   }
   FX_Free(img->comps[0].data);
   img->comps[0].data = d0;
   FX_Free(img->comps[1].data);
   img->comps[1].data = d1;
   FX_Free(img->comps[2].data);
   img->comps[2].data = d2;
 }
+static bool sycc420_422_size_is_valid(opj_image_t* img) {
+  return (img && img->comps[0].w != std::numeric_limits<OPJ_UINT32>::max() &&
+          (img->comps[0].w + 1) / 2 == img->comps[1].w &&
+          img->comps[1].w == img->comps[2].w &&
+          img->comps[1].h == img->comps[2].h);
+}
+static bool sycc420_size_is_valid(opj_image_t* img) {
+  return (sycc420_422_size_is_valid(img) &&
+          img->comps[0].h != std::numeric_limits<OPJ_UINT32>::max() &&
+          (img->comps[0].h + 1) / 2 == img->comps[1].h);
+}
+static bool sycc422_size_is_valid(opj_image_t* img) {
+  return (sycc420_422_size_is_valid(img) && img->comps[0].h == img->comps[1].h);
+}
 static void sycc422_to_rgb(opj_image_t* img) {
+  if (!sycc422_size_is_valid(img))
+    return;
+
   int prec = img->comps[0].prec;
   int offset = 1 << (prec - 1);
   int upb = (1 << prec) - 1;
-  OPJ_UINT32 maxw =
-      std::min(std::min(img->comps[0].w, img->comps[1].w), img->comps[2].w);
-  OPJ_UINT32 maxh =
-      std::min(std::min(img->comps[0].h, img->comps[1].h), img->comps[2].h);
+
+  OPJ_UINT32 maxw = img->comps[0].w;
+  OPJ_UINT32 maxh = img->comps[0].h;
   FX_SAFE_SIZE_T max_size = maxw;
   max_size *= maxh;
   if (!max_size.IsValid())
     return;
 
   const int* y = img->comps[0].data;
   const int* cb = img->comps[1].data;
   const int* cr = img->comps[2].data;
   int *d0, *d1, *d2, *r, *g, *b;
   d0 = r = FX_Alloc(int, max_size.ValueOrDie());
@@ skipping 33 matching lines @@
   img->comps[2].data = d2;
   img->comps[1].w = maxw;
   img->comps[1].h = maxh;
   img->comps[2].w = maxw;
   img->comps[2].h = maxh;
   img->comps[1].dx = img->comps[0].dx;
   img->comps[2].dx = img->comps[0].dx;
   img->comps[1].dy = img->comps[0].dy;
   img->comps[2].dy = img->comps[0].dy;
 }
-static bool sycc420_size_is_valid(OPJ_UINT32 y, OPJ_UINT32 cbcr) {
-  if (!y || !cbcr)
-    return false;
-
-  return (cbcr == y / 2) || ((y & 1) && (cbcr == y / 2 + 1));
-}
 static bool sycc420_must_extend_cbcr(OPJ_UINT32 y, OPJ_UINT32 cbcr) {
   return (y & 1) && (cbcr == y / 2);
 }
 void sycc420_to_rgb(opj_image_t* img) {
+  if (!sycc420_size_is_valid(img))
+    return;
+
   OPJ_UINT32 prec = img->comps[0].prec;
   if (!prec)
     return;
   OPJ_UINT32 offset = 1 << (prec - 1);
   OPJ_UINT32 upb = (1 << prec) - 1;
   OPJ_UINT32 yw = img->comps[0].w;
   OPJ_UINT32 yh = img->comps[0].h;
   OPJ_UINT32 cbw = img->comps[1].w;
   OPJ_UINT32 cbh = img->comps[1].h;
   OPJ_UINT32 crw = img->comps[2].w;
-  OPJ_UINT32 crh = img->comps[2].h;
-  if (cbw != crw || cbh != crh)
-    return;
-  if (!sycc420_size_is_valid(yw, cbw) || !sycc420_size_is_valid(yh, cbh))
-    return;
   bool extw = sycc420_must_extend_cbcr(yw, cbw);
   bool exth = sycc420_must_extend_cbcr(yh, cbh);
   FX_SAFE_DWORD safeSize = yw;
   safeSize *= yh;
   if (!safeSize.IsValid())
     return;
   int* r = FX_Alloc(int, safeSize.ValueOrDie());
   int* g = FX_Alloc(int, safeSize.ValueOrDie());
   int* b = FX_Alloc(int, safeSize.ValueOrDie());
   int* d0 = r;
@@ skipping 578 matching lines @@
 bool CCodec_JpxModule::Decode(CJPX_Decoder* pDecoder,
                               uint8_t* dest_data,
                               int pitch,
                               const std::vector<uint8_t>& offsets) {
   return pDecoder->Decode(dest_data, pitch, offsets);
 }
 
 void CCodec_JpxModule::DestroyDecoder(CJPX_Decoder* pDecoder) {
   delete pDecoder;
 }