Bound total pixels in JBig2 images to avoid overflows later.

core/fxcodec/jbig2/JBig2_TrdProc.cpp

 // Copyright 2015 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fxcodec/jbig2/JBig2_TrdProc.h"
 
 #include <memory>
 
@@ skipping 96 matching lines @@
             (pHuffmanDecoder->decodeAValue(SBHUFFRDY, &RDYI) != 0) ||
             (pHuffmanDecoder->decodeAValue(SBHUFFRSIZE, &nVal) != 0)) {
           return nullptr;
         }
         pStream->alignByte();
         uint32_t nTmp = pStream->getOffset();
         CJBig2_Image* IBOI = SBSYMS[IDI];
         if (!IBOI)
           return nullptr;
 
-        uint32_t WOI = IBOI->m_nWidth;
-        uint32_t HOI = IBOI->m_nHeight;
+        uint32_t WOI = IBOI->width();
+        uint32_t HOI = IBOI->height();
         if ((int)(WOI + RDWI) < 0 || (int)(HOI + RDHI) < 0)
           return nullptr;
 
         std::unique_ptr<CJBig2_GRRDProc> pGRRD(new CJBig2_GRRDProc());
         pGRRD->GRW = WOI + RDWI;
         pGRRD->GRH = HOI + RDHI;
         pGRRD->GRTEMPLATE = SBRTEMPLATE;
         pGRRD->GRREFERENCE = IBOI;
         pGRRD->GRREFERENCEDX = (RDWI >> 2) + RDXI;
         pGRRD->GRREFERENCEDY = (RDHI >> 2) + RDYI;
@@ skipping 14 matching lines @@
         pStream->alignByte();
         pStream->offset(2);
         if ((uint32_t)nVal != (pStream->getOffset() - nTmp)) {
           delete IBI;
           return nullptr;
         }
       }
       if (!IBI) {
         continue;
       }
-      uint32_t WI = IBI->m_nWidth;
-      uint32_t HI = IBI->m_nHeight;
+      uint32_t WI = IBI->width();
+      uint32_t HI = IBI->height();
       if (TRANSPOSED == 0 && ((REFCORNER == JBIG2_CORNER_TOPRIGHT) ||
                               (REFCORNER == JBIG2_CORNER_BOTTOMRIGHT))) {
         CURS = CURS + WI - 1;
       } else if (TRANSPOSED == 1 && ((REFCORNER == JBIG2_CORNER_BOTTOMLEFT) ||
                                      (REFCORNER == JBIG2_CORNER_BOTTOMRIGHT))) {
         CURS = CURS + HI - 1;
       }
       int32_t SI = CURS;
       if (TRANSPOSED == 0) {
         switch (REFCORNER) {
@@ skipping 155 matching lines @@
         int32_t RDXI;
         int32_t RDYI;
         pIARDW->decode(pArithDecoder, &RDWI);
         pIARDH->decode(pArithDecoder, &RDHI);
         pIARDX->decode(pArithDecoder, &RDXI);
         pIARDY->decode(pArithDecoder, &RDYI);
         CJBig2_Image* IBOI = SBSYMS[IDI];
         if (!IBOI)
           return nullptr;
 
-        uint32_t WOI = IBOI->m_nWidth;
-        uint32_t HOI = IBOI->m_nHeight;
+        uint32_t WOI = IBOI->width();
+        uint32_t HOI = IBOI->height();
         if ((int)(WOI + RDWI) < 0 || (int)(HOI + RDHI) < 0)
           return nullptr;
 
         std::unique_ptr<CJBig2_GRRDProc> pGRRD(new CJBig2_GRRDProc());
         pGRRD->GRW = WOI + RDWI;
         pGRRD->GRH = HOI + RDHI;
         pGRRD->GRTEMPLATE = SBRTEMPLATE;
         pGRRD->GRREFERENCE = IBOI;
         pGRRD->GRREFERENCEDX = (RDWI >> 1) + RDXI;
         pGRRD->GRREFERENCEDY = (RDHI >> 1) + RDYI;
         pGRRD->TPGRON = 0;
         pGRRD->GRAT[0] = SBRAT[0];
         pGRRD->GRAT[1] = SBRAT[1];
         pGRRD->GRAT[2] = SBRAT[2];
         pGRRD->GRAT[3] = SBRAT[3];
         IBI.reset(pGRRD->decode(pArithDecoder, grContext));
         pIBI = IBI.get();
       }
       if (!pIBI)
         return nullptr;
 
-      uint32_t WI = pIBI->m_nWidth;
-      uint32_t HI = pIBI->m_nHeight;
+      uint32_t WI = pIBI->width();
+      uint32_t HI = pIBI->height();
       if (TRANSPOSED == 0 && ((REFCORNER == JBIG2_CORNER_TOPRIGHT) ||
                               (REFCORNER == JBIG2_CORNER_BOTTOMRIGHT))) {
         CURS += WI - 1;
       } else if (TRANSPOSED == 1 && ((REFCORNER == JBIG2_CORNER_BOTTOMLEFT) ||
                                      (REFCORNER == JBIG2_CORNER_BOTTOMRIGHT))) {
         CURS += HI - 1;
       }
       int32_t SI = CURS;
       if (TRANSPOSED == 0) {
         switch (REFCORNER) {
@@ skipping 31 matching lines @@
         CURS += WI - 1;
       } else if (TRANSPOSED == 1 && ((REFCORNER == JBIG2_CORNER_TOPLEFT) ||
                                      (REFCORNER == JBIG2_CORNER_TOPRIGHT))) {
         CURS += HI - 1;
       }
       ++NINSTANCES;
     }
   }
   return SBREG.release();
 }