Bound total pixels in JBig2 images to avoid overflows later.

core/fxcodec/jbig2/JBig2_SddProc.cpp

 // Copyright 2015 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fxcodec/jbig2/JBig2_SddProc.h"
 
 #include <memory>
 #include <vector>
@@ skipping 505 matching lines @@
     if (SDREFAGG == 0) {
       if (pHuffmanDecoder->decodeAValue(SDHUFFBMSIZE, (int32_t*)&BMSIZE) != 0) {
         goto failed;
       }
       pStream->alignByte();
       if (BMSIZE == 0) {
         stride = (TOTWIDTH + 7) >> 3;
         if (pStream->getByteLeft() >= stride * HCHEIGHT) {
           BHC = new CJBig2_Image(TOTWIDTH, HCHEIGHT);
           for (I = 0; I < HCHEIGHT; I++) {
-            JBIG2_memcpy(BHC->m_pData + I * BHC->m_nStride,
+            JBIG2_memcpy(BHC->m_pData + I * BHC->stride(),
                          pStream->getPointer(), stride);
             pStream->offset(stride);
           }
         } else {
           goto failed;
         }
       } else {
         std::unique_ptr<CJBig2_GRDProc> pGRD(new CJBig2_GRDProc());
         pGRD->MMR = 1;
         pGRD->GBW = TOTWIDTH;
@@ skipping 57 matching lines @@
 failed:
   for (I = 0; I < NSYMSDECODED; I++) {
     delete SDNEWSYMS[I];
   }
   FX_Free(SDNEWSYMS);
   if (SDREFAGG == 0) {
     FX_Free(SDNEWSYMWIDTHS);
   }
   return nullptr;
 }