Bound total pixels in JBig2 images to avoid overflows later.

core/fxcodec/jbig2/JBig2_GrrdProc.cpp

 // Copyright 2015 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fxcodec/jbig2/JBig2_GrrdProc.h"
 
 #include <memory>
 
 #include "core/fxcodec/jbig2/JBig2_ArithDecoder.h"
 #include "core/fxcodec/jbig2/JBig2_BitStream.h"
 #include "core/fxcodec/jbig2/JBig2_Image.h"
 
 CJBig2_Image* CJBig2_GRRDProc::decode(CJBig2_ArithDecoder* pArithDecoder,
                                       JBig2ArithCtx* grContext) {
   if (GRW == 0 || GRH == 0)
     return new CJBig2_Image(GRW, GRH);
 
   if (GRTEMPLATE == 0) {
     if ((GRAT[0] == -1) && (GRAT[1] == -1) && (GRAT[2] == -1) &&
         (GRAT[3] == -1) && (GRREFERENCEDX == 0) &&
-        (GRW == (uint32_t)GRREFERENCE->m_nWidth)) {
+        (GRW == (uint32_t)GRREFERENCE->width())) {
       return decode_Template0_opt(pArithDecoder, grContext);
     }
     return decode_Template0_unopt(pArithDecoder, grContext);
   }
 
-  if ((GRREFERENCEDX == 0) && (GRW == (uint32_t)GRREFERENCE->m_nWidth))
+  if ((GRREFERENCEDX == 0) && (GRW == (uint32_t)GRREFERENCE->width()))
     return decode_Template1_opt(pArithDecoder, grContext);
   return decode_Template1_unopt(pArithDecoder, grContext);
 }
 
 CJBig2_Image* CJBig2_GRRDProc::decode_Template0_unopt(
     CJBig2_ArithDecoder* pArithDecoder,
     JBig2ArithCtx* grContext) {
   FX_BOOL LTP = FALSE;
   std::unique_ptr<CJBig2_Image> GRREG(new CJBig2_Image(GRW, GRH));
   GRREG->fill(0);
@@ skipping 115 matching lines @@
 
   int32_t iGRW = static_cast<int32_t>(GRW);
   int32_t iGRH = static_cast<int32_t>(GRH);
   std::unique_ptr<CJBig2_Image> GRREG(new CJBig2_Image(iGRW, iGRH));
   if (!GRREG->m_pData)
     return nullptr;
 
   FX_BOOL LTP = FALSE;
   uint8_t* pLine = GRREG->m_pData;
   uint8_t* pLineR = GRREFERENCE->m_pData;
-  intptr_t nStride = GRREG->m_nStride;
-  intptr_t nStrideR = GRREFERENCE->m_nStride;
-  int32_t GRWR = GRREFERENCE->m_nWidth;
-  int32_t GRHR = GRREFERENCE->m_nHeight;
+  intptr_t nStride = GRREG->stride();
+  intptr_t nStrideR = GRREFERENCE->stride();
+  int32_t GRWR = GRREFERENCE->width();
+  int32_t GRHR = GRREFERENCE->height();
   if (GRREFERENCEDY < -GRHR + 1 || GRREFERENCEDY > GRHR - 1)
     GRREFERENCEDY = 0;
   intptr_t nOffset = -GRREFERENCEDY * nStrideR;
   for (int32_t h = 0; h < iGRH; h++) {
     if (TPGRON)
       LTP = LTP ^ pArithDecoder->DECODE(&grContext[0x0010]);
     uint32_t line1 = (h > 0) ? pLine[-nStride] << 4 : 0;
     int32_t reference_h = h - GRREFERENCEDY;
     FX_BOOL line1_r_ok = (reference_h > 0 && reference_h < GRHR + 1);
     FX_BOOL line2_r_ok = (reference_h > -1 && reference_h < GRHR);
@@ skipping 210 matching lines @@
 
   int32_t iGRW = static_cast<int32_t>(GRW);
   int32_t iGRH = static_cast<int32_t>(GRH);
   std::unique_ptr<CJBig2_Image> GRREG(new CJBig2_Image(iGRW, iGRH));
   if (!GRREG->m_pData)
     return nullptr;
 
   FX_BOOL LTP = FALSE;
   uint8_t* pLine = GRREG->m_pData;
   uint8_t* pLineR = GRREFERENCE->m_pData;
-  intptr_t nStride = GRREG->m_nStride;
-  intptr_t nStrideR = GRREFERENCE->m_nStride;
-  int32_t GRWR = GRREFERENCE->m_nWidth;
-  int32_t GRHR = GRREFERENCE->m_nHeight;
+  intptr_t nStride = GRREG->stride();
+  intptr_t nStrideR = GRREFERENCE->stride();
+  int32_t GRWR = GRREFERENCE->width();
+  int32_t GRHR = GRREFERENCE->height();
   if (GRREFERENCEDY < -GRHR + 1 || GRREFERENCEDY > GRHR - 1) {
     GRREFERENCEDY = 0;
   }
   intptr_t nOffset = -GRREFERENCEDY * nStrideR;
   for (int32_t h = 0; h < iGRH; h++) {
     if (TPGRON)
       LTP = LTP ^ pArithDecoder->DECODE(&grContext[0x0008]);
     uint32_t line1 = (h > 0) ? pLine[-nStride] << 1 : 0;
     int32_t reference_h = h - GRREFERENCEDY;
     FX_BOOL line1_r_ok = (reference_h > 0 && reference_h < GRHR + 1);
@@ skipping 81 matching lines @@
         pLine[w >> 3] = cVal;
       }
     }
     pLine += nStride;
     if (h < GRHR + GRREFERENCEDY) {
       pLineR += nStrideR;
     }
   }
   return GRREG.release();
 }