Bound total pixels in JBig2 images to avoid overflows later.

core/fxcodec/jbig2/JBig2_GrdProc.cpp

 // Copyright 2015 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fxcodec/jbig2/JBig2_GrdProc.h"
 
 #include <memory>
 
@@ skipping 53 matching lines @@
 }
 CJBig2_Image* CJBig2_GRDProc::decode_Arith_Template0_opt3(
     CJBig2_ArithDecoder* pArithDecoder,
     JBig2ArithCtx* gbContext) {
   std::unique_ptr<CJBig2_Image> GBREG(new CJBig2_Image(GBW, GBH));
   if (!GBREG->m_pData)
     return nullptr;
 
   FX_BOOL LTP = FALSE;
   uint8_t* pLine = GBREG->m_pData;
-  int32_t nStride = GBREG->m_nStride;
+  int32_t nStride = GBREG->stride();
   int32_t nStride2 = nStride << 1;
   int32_t nLineBytes = ((GBW + 7) >> 3) - 1;
   int32_t nBitsLeft = GBW - (nLineBytes << 3);
   uint32_t height = GBH & 0x7fffffff;
   for (uint32_t h = 0; h < height; h++) {
     if (TPGDON)
       LTP = LTP ^ pArithDecoder->DECODE(&gbContext[0x9b25]);
     if (LTP) {
       GBREG->copyLine(h, h - 1);
     } else {
@@ skipping 105 matching lines @@
 
 CJBig2_Image* CJBig2_GRDProc::decode_Arith_Template1_opt3(
     CJBig2_ArithDecoder* pArithDecoder,
     JBig2ArithCtx* gbContext) {
   std::unique_ptr<CJBig2_Image> GBREG(new CJBig2_Image(GBW, GBH));
   if (!GBREG->m_pData)
     return nullptr;
 
   FX_BOOL LTP = FALSE;
   uint8_t* pLine = GBREG->m_pData;
-  int32_t nStride = GBREG->m_nStride;
+  int32_t nStride = GBREG->stride();
   int32_t nStride2 = nStride << 1;
   int32_t nLineBytes = ((GBW + 7) >> 3) - 1;
   int32_t nBitsLeft = GBW - (nLineBytes << 3);
   for (uint32_t h = 0; h < GBH; h++) {
     if (TPGDON)
       LTP = LTP ^ pArithDecoder->DECODE(&gbContext[0x0795]);
     if (LTP) {
       GBREG->copyLine(h, h - 1);
     } else {
       if (h > 1) {
@@ skipping 102 matching lines @@
 
 CJBig2_Image* CJBig2_GRDProc::decode_Arith_Template2_opt3(
     CJBig2_ArithDecoder* pArithDecoder,
     JBig2ArithCtx* gbContext) {
   std::unique_ptr<CJBig2_Image> GBREG(new CJBig2_Image(GBW, GBH));
   if (!GBREG->m_pData)
     return nullptr;
 
   FX_BOOL LTP = FALSE;
   uint8_t* pLine = GBREG->m_pData;
-  int32_t nStride = GBREG->m_nStride;
+  int32_t nStride = GBREG->stride();
   int32_t nStride2 = nStride << 1;
   int32_t nLineBytes = ((GBW + 7) >> 3) - 1;
   int32_t nBitsLeft = GBW - (nLineBytes << 3);
   for (uint32_t h = 0; h < GBH; h++) {
     if (TPGDON)
       LTP = LTP ^ pArithDecoder->DECODE(&gbContext[0x00e5]);
     if (LTP) {
       GBREG->copyLine(h, h - 1);
     } else {
       if (h > 1) {
@@ skipping 100 matching lines @@
 
 CJBig2_Image* CJBig2_GRDProc::decode_Arith_Template3_opt3(
     CJBig2_ArithDecoder* pArithDecoder,
     JBig2ArithCtx* gbContext) {
   std::unique_ptr<CJBig2_Image> GBREG(new CJBig2_Image(GBW, GBH));
   if (!GBREG->m_pData)
     return nullptr;
 
   FX_BOOL LTP = FALSE;
   uint8_t* pLine = GBREG->m_pData;
-  int32_t nStride = GBREG->m_nStride;
+  int32_t nStride = GBREG->stride();
   int32_t nLineBytes = ((GBW + 7) >> 3) - 1;
   int32_t nBitsLeft = GBW - (nLineBytes << 3);
   for (uint32_t h = 0; h < GBH; h++) {
     if (TPGDON)
       LTP = LTP ^ pArithDecoder->DECODE(&gbContext[0x0195]);
     if (LTP) {
       GBREG->copyLine(h, h - 1);
     } else {
       if (h > 0) {
         uint8_t* pLine1 = pLine - nStride;
@@ skipping 140 matching lines @@
   } else {
     if (UseTemplate23Opt3()) {
       m_ProssiveStatus = decode_Arith_Template3_opt3(pImage, m_pArithDecoder,
                                                      m_gbContext, pPause);
     } else {
       m_ProssiveStatus = decode_Arith_Template3_unopt(pImage, m_pArithDecoder,
                                                       m_gbContext, pPause);
     }
   }
   m_ReplaceRect.left = 0;
-  m_ReplaceRect.right = pImage->m_nWidth;
+  m_ReplaceRect.right = pImage->width();
   m_ReplaceRect.top = iline;
   m_ReplaceRect.bottom = m_loopIndex;
   if (m_ProssiveStatus == FXCODEC_STATUS_DECODE_FINISH) {
     m_loopIndex = 0;
   }
   return m_ProssiveStatus;
 }
 
 FXCODEC_STATUS CJBig2_GRDProc::Start_decode_MMR(CJBig2_Image** pImage,
                                                 CJBig2_BitStream* pStream,
                                                 IFX_Pause* pPause) {
   int bitpos, i;
   *pImage = new CJBig2_Image(GBW, GBH);
   if (!(*pImage)->m_pData) {
     delete (*pImage);
     (*pImage) = nullptr;
     m_ProssiveStatus = FXCODEC_STATUS_ERROR;
     return m_ProssiveStatus;
   }
   bitpos = (int)pStream->getBitPos();
   FaxG4Decode(pStream->getBuf(), pStream->getLength(), &bitpos,
-              (*pImage)->m_pData, GBW, GBH, (*pImage)->m_nStride);
+              (*pImage)->m_pData, GBW, GBH, (*pImage)->stride());
   pStream->setBitPos(bitpos);
-  for (i = 0; (uint32_t)i < (*pImage)->m_nStride * GBH; i++) {
+  for (i = 0; (uint32_t)i < (*pImage)->stride() * GBH; i++) {
     (*pImage)->m_pData[i] = ~(*pImage)->m_pData[i];
   }
   m_ProssiveStatus = FXCODEC_STATUS_DECODE_FINISH;
   return m_ProssiveStatus;
 }
 
 FXCODEC_STATUS CJBig2_GRDProc::Continue_decode(IFX_Pause* pPause) {
   if (m_ProssiveStatus != FXCODEC_STATUS_DECODE_TOBECONTINUE)
     return m_ProssiveStatus;
 
   if (m_DecodeType != 1) {
     m_ProssiveStatus = FXCODEC_STATUS_ERROR;
     return m_ProssiveStatus;
   }
 
   return decode_Arith(pPause);
 }
 
 FXCODEC_STATUS CJBig2_GRDProc::decode_Arith_Template0_opt3(
     CJBig2_Image* pImage,
     CJBig2_ArithDecoder* pArithDecoder,
     JBig2ArithCtx* gbContext,
     IFX_Pause* pPause) {
   if (!m_pLine) {
     m_pLine = pImage->m_pData;
   }
-  int32_t nStride = pImage->m_nStride;
+  int32_t nStride = pImage->stride();
   int32_t nStride2 = nStride << 1;
   int32_t nLineBytes = ((GBW + 7) >> 3) - 1;
   int32_t nBitsLeft = GBW - (nLineBytes << 3);
   uint32_t height = GBH & 0x7fffffff;
   for (; m_loopIndex < height; m_loopIndex++) {
     if (TPGDON)
       m_LTP = m_LTP ^ pArithDecoder->DECODE(&gbContext[0x9b25]);
     if (m_LTP) {
       pImage->copyLine(m_loopIndex, m_loopIndex - 1);
     } else {
@@ skipping 117 matching lines @@
 }
 
 FXCODEC_STATUS CJBig2_GRDProc::decode_Arith_Template1_opt3(
     CJBig2_Image* pImage,
     CJBig2_ArithDecoder* pArithDecoder,
     JBig2ArithCtx* gbContext,
     IFX_Pause* pPause) {
   if (!m_pLine) {
     m_pLine = pImage->m_pData;
   }
-  int32_t nStride = pImage->m_nStride;
+  int32_t nStride = pImage->stride();
   int32_t nStride2 = nStride << 1;
   int32_t nLineBytes = ((GBW + 7) >> 3) - 1;
   int32_t nBitsLeft = GBW - (nLineBytes << 3);
   for (; m_loopIndex < GBH; m_loopIndex++) {
     if (TPGDON)
       m_LTP = m_LTP ^ pArithDecoder->DECODE(&gbContext[0x0795]);
     if (m_LTP) {
       pImage->copyLine(m_loopIndex, m_loopIndex - 1);
     } else {
       if (m_loopIndex > 1) {
@@ skipping 112 matching lines @@
 }
 
 FXCODEC_STATUS CJBig2_GRDProc::decode_Arith_Template2_opt3(
     CJBig2_Image* pImage,
     CJBig2_ArithDecoder* pArithDecoder,
     JBig2ArithCtx* gbContext,
     IFX_Pause* pPause) {
   if (!m_pLine) {
     m_pLine = pImage->m_pData;
   }
-  int32_t nStride = pImage->m_nStride;
+  int32_t nStride = pImage->stride();
   int32_t nStride2 = nStride << 1;
   int32_t nLineBytes = ((GBW + 7) >> 3) - 1;
   int32_t nBitsLeft = GBW - (nLineBytes << 3);
   for (; m_loopIndex < GBH; m_loopIndex++) {
     if (TPGDON)
       m_LTP = m_LTP ^ pArithDecoder->DECODE(&gbContext[0x00e5]);
     if (m_LTP) {
       pImage->copyLine(m_loopIndex, m_loopIndex - 1);
     } else {
       if (m_loopIndex > 1) {
@@ skipping 112 matching lines @@
 }
 
 FXCODEC_STATUS CJBig2_GRDProc::decode_Arith_Template3_opt3(
     CJBig2_Image* pImage,
     CJBig2_ArithDecoder* pArithDecoder,
     JBig2ArithCtx* gbContext,
     IFX_Pause* pPause) {
   if (!m_pLine)
     m_pLine = pImage->m_pData;
 
-  int32_t nStride = pImage->m_nStride;
+  int32_t nStride = pImage->stride();
   int32_t nLineBytes = ((GBW + 7) >> 3) - 1;
   int32_t nBitsLeft = GBW - (nLineBytes << 3);
   for (; m_loopIndex < GBH; m_loopIndex++) {
     if (TPGDON)
       m_LTP = m_LTP ^ pArithDecoder->DECODE(&gbContext[0x0195]);
     if (m_LTP) {
       pImage->copyLine(m_loopIndex, m_loopIndex - 1);
     } else {
       if (m_loopIndex > 0) {
         uint8_t* pLine1 = m_pLine - nStride;
@@ skipping 84 matching lines @@
     }
     if (pPause && pPause->NeedToPauseNow()) {
       m_loopIndex++;
       m_ProssiveStatus = FXCODEC_STATUS_DECODE_TOBECONTINUE;
       return FXCODEC_STATUS_DECODE_TOBECONTINUE;
     }
   }
   m_ProssiveStatus = FXCODEC_STATUS_DECODE_FINISH;
   return FXCODEC_STATUS_DECODE_FINISH;
 }