Bound total pixels in JBig2 images to avoid overflows later.

core/fxcodec/jbig2/JBig2_Image.h

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #ifndef CORE_FXCODEC_JBIG2_JBIG2_IMAGE_H_
 #define CORE_FXCODEC_JBIG2_JBIG2_IMAGE_H_
 
 #include "core/fxcodec/jbig2/JBig2_Define.h"
 
+struct FX_RECT;
+
 enum JBig2ComposeOp {
   JBIG2_COMPOSE_OR = 0,
   JBIG2_COMPOSE_AND = 1,
   JBIG2_COMPOSE_XOR = 2,
   JBIG2_COMPOSE_XNOR = 3,
   JBIG2_COMPOSE_REPLACE = 4
 };
 
-struct FX_RECT;
 class CJBig2_Image {
  public:
   CJBig2_Image(int32_t w, int32_t h);
-
   CJBig2_Image(int32_t w, int32_t h, int32_t stride, uint8_t* pBuf);
-
   CJBig2_Image(const CJBig2_Image& im);
-
   ~CJBig2_Image();
 
+  int32_t width() const { return m_nWidth; }
+  int32_t height() const { return m_nHeight; }
+  int32_t stride() const { return m_nStride; }
+
   FX_BOOL getPixel(int32_t x, int32_t y);
-
   int32_t setPixel(int32_t x, int32_t y, FX_BOOL v);
 
   void copyLine(int32_t hTo, int32_t hFrom);
-
   void fill(FX_BOOL v);
 
   FX_BOOL composeTo(CJBig2_Image* pDst,
                     int32_t x,
                     int32_t y,
                     JBig2ComposeOp op);
   FX_BOOL composeTo(CJBig2_Image* pDst,
                     int32_t x,
                     int32_t y,
                     JBig2ComposeOp op,
@@ skipping 13 matching lines @@
                       int32_t y,
                       CJBig2_Image* pSrc,
                       JBig2ComposeOp op);
   FX_BOOL composeFrom(int32_t x,
                       int32_t y,
                       CJBig2_Image* pSrc,
                       JBig2ComposeOp op,
                       const FX_RECT* pSrcRect);
 
   CJBig2_Image* subImage(int32_t x, int32_t y, int32_t w, int32_t h);
-
   void expand(int32_t h, FX_BOOL v);
 
- public:
-  int32_t m_nWidth;
-
-  int32_t m_nHeight;
-
-  int32_t m_nStride;
-
   uint8_t* m_pData;
 
+ private:
+  int32_t m_nWidth;   // 1-bit pixels
+  int32_t m_nHeight;  // lines
+  int32_t m_nStride;  // bytes
   FX_BOOL m_bNeedFree;

[Lei Zhang, 2016/08/01 22:49:50]

const bool

[Tom Sepez, 2016/08/01 23:21:13]

Adding this "const" still compiles, but it shouldn't, since the 
expand() method, if implemented proplery, might have to change the setting when
it makes a new buffer.

But it's not implemented properly.

I think you can create an image w/ external buffer, and then expand it in the
h_direction, which might cause an alloc.  But it doesn't set the flag properly
in that case. Instead, it then causes realloc to be invoked on a the external
buffer, which may be non-heap memory.  Yay. 

Given this case, if it reallocs, we leak the newly returned buffer, and make the
caller's ptr invalid.

argh.

 };
 
 #endif  // CORE_FXCODEC_JBIG2_JBIG2_IMAGE_H_