Validate the BitsPerFlag entry in shading dictionaries.

core/fpdfapi/fpdf_page/fpdf_page_parser.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_page/pageint.h"
 
 #include <vector>
 
@@ skipping 88 matching lines @@
 }
 
 CFX_FloatRect GetShadingBBox(CPDF_ShadingPattern* pShading,
                              const CFX_Matrix& matrix) {
   ShadingType type = pShading->GetShadingType();
   CPDF_Stream* pStream = ToStream(pShading->GetShadingObject());
   CPDF_ColorSpace* pCS = pShading->GetCS();
   if (!pStream || !pCS)
     return CFX_FloatRect(0, 0, 0, 0);
 
-  CPDF_MeshStream stream(pShading->GetFuncs(), pCS);
-  if (!stream.Load(pStream))
+  CPDF_MeshStream stream(type, pShading->GetFuncs(), pStream, pCS);
+  if (!stream.Load())
     return CFX_FloatRect(0, 0, 0, 0);
 
   CFX_FloatRect rect;
   bool bStarted = false;
   bool bGouraud = type == kFreeFormGouraudTriangleMeshShading ||
                   type == kLatticeFormGouraudTriangleMeshShading;
 
   int point_count = kSingleCoordinatePair;
   if (type == kTensorProductPatchMeshShading)
     point_count = kTensorCoordinatePairs;
@@ skipping 1575 matching lines @@
         } else {
           PDF_ReplaceAbbr(pElement);
         }
       }
       break;
     }
     default:
       break;
   }
 }