Prevent an OOB access in CPDF_DIBSource::TranslateScanline24bpp

core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp

Index: core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp
diff --git a/core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp b/core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp
index 7b88e84399d90b15cb81cdda1e1f283bc91aa753..052d1d5b52ae4f4d070c8501d89ad358f6c9843c 100644
--- a/core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp
+++ b/core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp
@@ -917,7 +917,8 @@ void CPDF_DIBSource::TranslateScanline24bpp(uint8_t* dest_scan,
   }
   unsigned int max_data = (1 << m_bpc) - 1;
   if (m_bDefaultDecode) {
-    if (m_Family == PDFCS_DEVICERGB || m_Family == PDFCS_CALRGB) {
+    if ((m_Family == PDFCS_DEVICERGB || m_Family == PDFCS_CALRGB) &&
+        m_nComponents == 3) {

[Tom Sepez, 2016/04/12 00:39:27]

Do we just want to return in error if m_nComponents is not 3 for these families?
 Or do we get good output if we continue?

[Oliver Chang, 2016/04/12 00:48:59]

I'm not sure if we get good output, but it doesn't look like the rest of the
code in this function makes similarly incorrect assumptions. Would it be better
to just return early to be safe? 

[Oliver Chang, 2016/04/12 16:36:22]

Done.

       const uint8_t* src_pos = src_scan;
       switch (m_bpc) {
         case 16: