Make CPDF_Function::Load() return an unique_ptr.

core/fpdfapi/fpdf_page/fpdf_page_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_page/pageint.h"
 
 #include <vector>
 
@@ skipping 79 matching lines @@
 CFX_ByteStringC PDF_FindFullName(const PDF_AbbrPair* table,
                                  size_t count,
                                  const CFX_ByteStringC& abbr) {
   auto it = std::find_if(
       table, table + count,
       [abbr](const PDF_AbbrPair& pair) { return pair.abbr == abbr; });
   return it != table + count ? CFX_ByteStringC(it->full_name)
                              : CFX_ByteStringC();
 }
 
-CFX_FloatRect GetShadingBBox(CPDF_Stream* pStream,
-                             ShadingType type,
-                             const CFX_Matrix& matrix,
-                             CPDF_Function** pFuncs,
-                             int nFuncs,
-                             CPDF_ColorSpace* pCS) {
-  if (!pStream || !pFuncs || !pCS)
+CFX_FloatRect GetShadingBBox(CPDF_ShadingPattern* pShading,
+                             const CFX_Matrix& matrix) {
+  ShadingType type = pShading->GetShadingType();
+  CPDF_Stream* pStream = ToStream(pShading->GetShadingObject());
+  CPDF_ColorSpace* pCS = pShading->GetCS();
+  if (!pStream || !pCS)
     return CFX_FloatRect(0, 0, 0, 0);
 
-  CPDF_MeshStream stream;
-  if (!stream.Load(pStream, pFuncs, nFuncs, pCS))
+  CPDF_MeshStream stream(pShading->GetFuncs(), pCS);
+  if (!stream.Load(pStream))
     return CFX_FloatRect(0, 0, 0, 0);
 
   CFX_FloatRect rect;
   bool bStarted = false;
   bool bGouraud = type == kFreeFormGouraudTriangleMeshShading ||
                   type == kLatticeFormGouraudTriangleMeshShading;
 
   int point_count = kSingleCoordinatePair;
   if (type == kTensorProductPatchMeshShading)
     point_count = kTensorCoordinatePairs;
   else if (type == kCoonsPatchMeshShading)
     point_count = kCoonsCoordinatePairs;
 
   int color_count = kSingleColorPerPatch;
   if (type == kCoonsPatchMeshShading || type == kTensorProductPatchMeshShading)
     color_count = kQuadColorsPerPatch;
 
-  while (!stream.m_BitStream.IsEOF()) {
+  while (!stream.BitStream()->IsEOF()) {
     uint32_t flag = 0;
     if (type != kLatticeFormGouraudTriangleMeshShading)
       flag = stream.GetFlag();
 
     if (!bGouraud && flag) {
       point_count -= 4;
       color_count -= 2;
     }
 
     for (int i = 0; i < point_count; i++) {
       FX_FLOAT x;
       FX_FLOAT y;
       stream.GetCoords(x, y);
       if (bStarted) {
         rect.UpdateRect(x, y);
       } else {
         rect.InitRect(x, y);
         bStarted = true;
       }
     }
-    stream.m_BitStream.SkipBits(stream.m_nComps * stream.m_nCompBits *
-                                color_count);
+    stream.BitStream()->SkipBits(stream.comps() * stream.CompBits() *

[Tom Sepez, 2016/05/23 19:09:33]

pre-existing: this multiply scares me, m_nCompBits looks to be pulled from a
dictionary and not bounds checked hence overflow possible.

[Lei Zhang, 2016/05/23 19:26:20]

Switched to FX_SAFE_UINT32.

+                                 color_count);
     if (bGouraud)
-      stream.m_BitStream.ByteAlign();
+      stream.BitStream()->ByteAlign();
   }
   rect.Transform(&matrix);
   return rect;
 }
 
 }  // namespace
 
 CFX_ByteStringC PDF_FindKeyAbbreviationForTesting(const CFX_ByteStringC& abbr) {
   return PDF_FindFullName(PDF_InlineKeyAbbr, FX_ArraySize(PDF_InlineKeyAbbr),
                           abbr);
@@ skipping 917 matching lines @@
 
 void CPDF_StreamContentParser::Handle_ShadeFill() {
   CPDF_Pattern* pPattern = FindPattern(GetString(0), true);
   if (!pPattern)
     return;
 
   CPDF_ShadingPattern* pShading = pPattern->AsShadingPattern();
   if (!pShading)
     return;
 
-  if (!pShading->m_bShadingObj || !pShading->Load())
+  if (!pShading->IsShadingObject() || !pShading->Load())
     return;
 
   std::unique_ptr<CPDF_ShadingObject> pObj(new CPDF_ShadingObject);
   pObj->m_pShading = pShading;
   SetGraphicStates(pObj.get(), FALSE, FALSE, FALSE);
   pObj->m_Matrix = m_pCurStates->m_CTM;
   pObj->m_Matrix.Concat(m_mtContentToUser);
   CFX_FloatRect bbox =
       pObj->m_ClipPath.IsNull() ? m_BBox : pObj->m_ClipPath.GetClipBox();
-  if (pShading->IsMeshShading()) {
-    bbox.Intersect(GetShadingBBox(ToStream(pShading->m_pShadingObj),
-                                  pShading->m_ShadingType, pObj->m_Matrix,
-                                  pShading->m_pFunctions, pShading->m_nFuncs,
-                                  pShading->m_pCS));
-  }
+  if (pShading->IsMeshShading())
+    bbox.Intersect(GetShadingBBox(pShading, pObj->m_Matrix));
   pObj->m_Left = bbox.left;
   pObj->m_Right = bbox.right;
   pObj->m_Top = bbox.top;
   pObj->m_Bottom = bbox.bottom;
   m_pObjectHolder->GetPageObjectList()->push_back(std::move(pObj));
 }
 
 void CPDF_StreamContentParser::Handle_SetCharSpace() {
   m_pCurStates->m_TextState.GetModify()->m_CharSpace = GetNumber(0);
 }
@@ skipping 582 matching lines @@
         } else {
           PDF_ReplaceAbbr(pElement);
         }
       }
       break;
     }
     default:
       break;
   }
 }