Validate the BitsPerFlag entry in shading dictionaries.

core/fpdfapi/fpdf_page/cpdf_meshstream.cpp

 // Copyright 2016 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_page/cpdf_meshstream.h"
 
 #include "core/fpdfapi/fpdf_page/include/cpdf_colorspace.h"
 #include "core/fpdfapi/fpdf_page/pageint.h"
@@ skipping 26 matching lines @@
     case 12:
     case 16:
     case 24:
     case 32:
       return true;
     default:
       return false;
   }
 }
 
+// See PDF Reference 1.7, page 315, table 4.32. (Also table 4.34)
+bool ShouldCheckBitsPerFlag(ShadingType type) {
+  switch (type) {
+    case kFreeFormGouraudTriangleMeshShading:
+    case kCoonsPatchMeshShading:
+    case kTensorProductPatchMeshShading:
+      return true;
+    default:
+      return false;
+  }
+}
+
+// Same references as ShouldCheckBitsPerFlag() above.
+bool IsValidBitsPerFlag(uint32_t x) {
+  switch (x) {
+    case 2:
+    case 4:
+    case 8:
+      return true;
+    default:
+      return false;
+  }
+}
+
 }  // namespace
 
 CPDF_MeshStream::CPDF_MeshStream(
+    ShadingType type,
     const std::vector<std::unique_ptr<CPDF_Function>>& funcs,
+    CPDF_Stream* pShadingStream,
     CPDF_ColorSpace* pCS)
-    : m_funcs(funcs), m_pCS(pCS) {}
+    : m_type(type),
+      m_funcs(funcs),
+      m_pShadingStream(pShadingStream),
+      m_pCS(pCS) {}
 
-bool CPDF_MeshStream::Load(CPDF_Stream* pShadingStream) {
-  m_Stream.LoadAllData(pShadingStream);
+bool CPDF_MeshStream::Load() {
+  m_Stream.LoadAllData(m_pShadingStream);
   m_BitStream.Init(m_Stream.GetData(), m_Stream.GetSize());
-  CPDF_Dictionary* pDict = pShadingStream->GetDict();
+  CPDF_Dictionary* pDict = m_pShadingStream->GetDict();
   m_nCoordBits = pDict->GetIntegerBy("BitsPerCoordinate");
   if (!IsValidBitsPerCoordinate(m_nCoordBits))
     return false;
 
   m_nCompBits = pDict->GetIntegerBy("BitsPerComponent");
   if (!IsValidBitsPerComponent(m_nCompBits))
     return false;
 
   m_nFlagBits = pDict->GetIntegerBy("BitsPerFlag");
+  if (ShouldCheckBitsPerFlag(m_type) && !IsValidBitsPerFlag(m_nFlagBits))
+    return false;
+
   uint32_t nComps = m_pCS->CountComponents();
   if (nComps > 8)
     return false;
 
   m_nComps = m_funcs.empty() ? nComps : 1;
   m_CoordMax = m_nCoordBits == 32 ? -1 : (1 << m_nCoordBits) - 1;
   m_CompMax = (1 << m_nCompBits) - 1;
   CPDF_Array* pDecode = pDict->GetArrayBy("Decode");
   if (!pDecode || pDecode->GetCount() != 4 + m_nComps * 2)
     return false;
 
   m_xmin = pDecode->GetNumberAt(0);
   m_xmax = pDecode->GetNumberAt(1);
   m_ymin = pDecode->GetNumberAt(2);
   m_ymax = pDecode->GetNumberAt(3);
   for (uint32_t i = 0; i < m_nComps; ++i) {
     m_ColorMin[i] = pDecode->GetNumberAt(i * 2 + 4);
     m_ColorMax[i] = pDecode->GetNumberAt(i * 2 + 5);
   }
   return true;
 }
 
 uint32_t CPDF_MeshStream::GetFlag() {
+  ASSERT(ShouldCheckBitsPerFlag(m_type));
   return m_BitStream.GetBits(m_nFlagBits) & 0x03;
 }
 
 void CPDF_MeshStream::GetCoords(FX_FLOAT& x, FX_FLOAT& y) {
   if (m_nCoordBits == 32) {
     x = m_xmin + (FX_FLOAT)(m_BitStream.GetBits(m_nCoordBits) *
                             (m_xmax - m_xmin) / (double)m_CoordMax);
     y = m_ymin + (FX_FLOAT)(m_BitStream.GetBits(m_nCoordBits) *
                             (m_ymax - m_ymin) / (double)m_CoordMax);
   } else {
     x = m_xmin +
         m_BitStream.GetBits(m_nCoordBits) * (m_xmax - m_xmin) / m_CoordMax;
     y = m_ymin +
         m_BitStream.GetBits(m_nCoordBits) * (m_ymax - m_ymin) / m_CoordMax;
   }
 }
 
 void CPDF_MeshStream::GetColor(FX_FLOAT& r, FX_FLOAT& g, FX_FLOAT& b) {
-  static const int kMaxResults = 8;
   FX_FLOAT color_value[kMaxResults];
   for (uint32_t i = 0; i < m_nComps; ++i) {
     color_value[i] = m_ColorMin[i] +
                      m_BitStream.GetBits(m_nCompBits) *
                          (m_ColorMax[i] - m_ColorMin[i]) / m_CompMax;
   }
   if (m_funcs.empty()) {
     m_pCS->GetRGB(color_value, r, g, b);
     return;
   }
@@ skipping 25 matching lines @@
     if (m_BitStream.IsEOF())
       return FALSE;
 
     GetCoords(vertex[i].x, vertex[i].y);
     pObject2Bitmap->Transform(vertex[i].x, vertex[i].y);
     GetColor(vertex[i].r, vertex[i].g, vertex[i].b);
     m_BitStream.ByteAlign();
   }
   return TRUE;
 }