Validate the BitsPerFlag entry in shading dictionaries.

core/fpdfapi/fpdf_render/fpdf_render_pattern.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_render/render_int.h"
 
 #include <algorithm>
 
@@ skipping 393 matching lines @@
 
 void DrawFreeGouraudShading(
     CFX_DIBitmap* pBitmap,
     CFX_Matrix* pObject2Bitmap,
     CPDF_Stream* pShadingStream,
     const std::vector<std::unique_ptr<CPDF_Function>>& funcs,
     CPDF_ColorSpace* pCS,
     int alpha) {
   ASSERT(pBitmap->GetFormat() == FXDIB_Argb);
 
-  CPDF_MeshStream stream(funcs, pCS);
-  if (!stream.Load(pShadingStream))
+  CPDF_MeshStream stream(kFreeFormGouraudTriangleMeshShading, funcs,
+                         pShadingStream, pCS);
+  if (!stream.Load())
     return;
 
   CPDF_MeshVertex triangle[3];
   FXSYS_memset(triangle, 0, sizeof(triangle));
 
   while (!stream.BitStream()->IsEOF()) {
     CPDF_MeshVertex vertex;
     uint32_t flag = stream.GetVertex(vertex, pObject2Bitmap);
     if (flag == 0) {
       triangle[0] = vertex;
@@ skipping 17 matching lines @@
     CPDF_Stream* pShadingStream,
     const std::vector<std::unique_ptr<CPDF_Function>>& funcs,
     CPDF_ColorSpace* pCS,
     int alpha) {
   ASSERT(pBitmap->GetFormat() == FXDIB_Argb);
 
   int row_verts = pShadingStream->GetDict()->GetIntegerBy("VerticesPerRow");
   if (row_verts < 2)
     return;
 
-  CPDF_MeshStream stream(funcs, pCS);
-  if (!stream.Load(pShadingStream))
+  CPDF_MeshStream stream(kLatticeFormGouraudTriangleMeshShading, funcs,
+                         pShadingStream, pCS);
+  if (!stream.Load())
     return;
 
   std::unique_ptr<CPDF_MeshVertex, FxFreeDeleter> vertex(
       FX_Alloc2D(CPDF_MeshVertex, row_verts, 2));
   if (!stream.GetVertexRow(vertex.get(), row_verts, pObject2Bitmap))
     return;
 
   int last_index = 0;
   while (1) {
     CPDF_MeshVertex* last_row = vertex.get() + last_index * row_verts;
@@ skipping 252 matching lines @@
              D1.second_half(), m2s);
         Draw(x_scale, y_scale, left + 1, bottom, C1.second_half(), m1s, m2f,
              D2.first_half());
         Draw(x_scale, y_scale, left + 1, bottom + 1, m1s, C2.second_half(), m2s,
              D2.second_half());
       }
     }
   }
 };
 
-bool CheckCoonTensorPara(const CPDF_MeshStream& stream) {
-  uint32_t coord = stream.CoordBits();
-  bool bCoordBitsValid =
-      (coord == 1 || coord == 2 || coord == 4 || coord == 8 || coord == 12 ||
-       coord == 16 || coord == 24 || coord == 32);
-
-  uint32_t comp = stream.CompBits();
-  bool bCompBitsValid = (comp == 1 || comp == 2 || comp == 4 || comp == 8 ||
-                         comp == 12 || comp == 16);
-
-  uint32_t flag = stream.FlagBits();
-  bool bFlagBitsValid = (flag == 2 || flag == 4 || flag == 8);
-
-  return bCoordBitsValid && bCompBitsValid && bFlagBitsValid;
-}
-
 void DrawCoonPatchMeshes(
-    FX_BOOL bTensor,
+    ShadingType type,
     CFX_DIBitmap* pBitmap,
     CFX_Matrix* pObject2Bitmap,
     CPDF_Stream* pShadingStream,
     const std::vector<std::unique_ptr<CPDF_Function>>& funcs,
     CPDF_ColorSpace* pCS,
     int fill_mode,
     int alpha) {
   ASSERT(pBitmap->GetFormat() == FXDIB_Argb);
+  ASSERT(type == kCoonsPatchMeshShading ||
+         type == kTensorProductPatchMeshShading);
 
   CFX_FxgeDevice device;
   device.Attach(pBitmap, false, nullptr, false);
-  CPDF_MeshStream stream(funcs, pCS);
-  if (!stream.Load(pShadingStream))
-    return;
-  if (!CheckCoonTensorPara(stream))
+  CPDF_MeshStream stream(type, funcs, pShadingStream, pCS);
+  if (!stream.Load())
     return;
 
   CPDF_PatchDrawer patch;
   patch.alpha = alpha;
   patch.pDevice = &device;
   patch.fill_mode = fill_mode;
   patch.path.SetPointCount(13);
   FX_PATHPOINT* pPoints = patch.path.GetPoints();
   pPoints[0].m_Flag = FXPT_MOVETO;
-  for (int i = 1; i < 13; i++) {
+  for (int i = 1; i < 13; i++)
     pPoints[i].m_Flag = FXPT_BEZIERTO;
-  }
   CFX_PointF coords[16];
-  int point_count = bTensor ? 16 : 12;
+  int point_count = type == kTensorProductPatchMeshShading ? 16 : 12;
   while (!stream.BitStream()->IsEOF()) {
     uint32_t flag = stream.GetFlag();
     int iStartPoint = 0, iStartColor = 0, i = 0;
     if (flag) {
       iStartPoint = 4;
       iStartColor = 2;
       CFX_PointF tempCoords[4];
       for (i = 0; i < 4; i++) {
         tempCoords[i] = coords[(flag * 3 + i) % 12];
       }
@@ skipping 143 matching lines @@
       if (CPDF_Stream* pStream = ToStream(pPattern->GetShadingObject())) {
         DrawLatticeGouraudShading(pBitmap, &FinalMatrix, pStream, funcs,
                                   pColorSpace, alpha);
       }
     } break;
     case kCoonsPatchMeshShading:
     case kTensorProductPatchMeshShading: {
       // The shading object can be a stream or a dictionary. We do not handle
       // the case of dictionary at the moment.
       if (CPDF_Stream* pStream = ToStream(pPattern->GetShadingObject())) {
-        DrawCoonPatchMeshes(
-            pPattern->GetShadingType() == kTensorProductPatchMeshShading,
-            pBitmap, &FinalMatrix, pStream, funcs, pColorSpace, fill_mode,
-            alpha);
+        DrawCoonPatchMeshes(pPattern->GetShadingType(), pBitmap, &FinalMatrix,
+                            pStream, funcs, pColorSpace, fill_mode, alpha);
       }
     } break;
   }
   if (bAlphaMode)
     pBitmap->LoadChannel(FXDIB_Red, pBitmap, FXDIB_Alpha);
 
   if (m_Options.m_ColorMode == RENDER_COLOR_GRAY)
     pBitmap->ConvertColorScale(m_Options.m_ForeColor, m_Options.m_BackColor);
   buffer.OutputToDevice();
 }
@@ skipping 256 matching lines @@
     }
   }
   if (bStroke) {
     CPDF_Color& StrokeColor = *pPathObj->m_ColorState.GetStrokeColor();
     if (StrokeColor.IsPattern()) {
       DrawPathWithPattern(pPathObj, pObj2Device, &StrokeColor, TRUE);
       bStroke = FALSE;
     }
   }
 }