Prevent a potential OOB read in TranslateImageLine.

core/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_render/render_int.h"
 
 #include <algorithm>
 #include <memory>
@@ skipping 552 matching lines @@
         pParams ? pParams->GetIntegerBy("ColorTransform", 1) : 1));
     if (!m_pDecoder) {
       FX_BOOL bTransform = FALSE;
       int comps;
       int bpc;
       CCodec_JpegModule* pJpegModule = CPDF_ModuleMgr::Get()->GetJpegModule();
       if (pJpegModule->LoadInfo(src_data, src_size, m_Width, m_Height, comps,
                                 bpc, bTransform)) {
         if (m_nComponents != static_cast<uint32_t>(comps)) {
           FX_Free(m_pCompData);
+          m_pCompData = nullptr;
           m_nComponents = static_cast<uint32_t>(comps);
+          if (m_pColorSpace &&
+              m_pColorSpace->CountComponents() != m_nComponents)
+            return 0;
           if (m_Family == PDFCS_LAB && m_nComponents != 3) {

[Tom Sepez, 2016/04/15 20:14:49]

nit: no {}

[Oliver Chang, 2016/04/15 20:40:26]

Done.

-            m_pCompData = nullptr;
             return 0;
           }
           m_pCompData = GetDecodeAndMaskArray(m_bDefaultDecode, m_bColorKey);
           if (!m_pCompData) {

[Tom Sepez, 2016/04/15 20:14:49]

here too

[Oliver Chang, 2016/04/15 20:40:26]

Done.

             return 0;
           }
         }
         m_bpc = bpc;
         m_pDecoder.reset(CPDF_ModuleMgr::Get()->GetJpegModule()->CreateDecoder(
             src_data, src_size, m_Width, m_Height, m_nComponents, bTransform));
       }
     }
   } else if (decoder == "FlateDecode") {
     m_pDecoder.reset(FPDFAPI_CreateFlateDecoder(
@@ skipping 981 matching lines @@
                                    IFX_Pause* pPause) {
   return LoadHandle->Continue(pPause);
 }
 
 CPDF_ImageLoader::~CPDF_ImageLoader() {
   if (!m_bCached) {
     delete m_pBitmap;
     delete m_pMask;
   }
 }