Bound total pixels in JBig2 images to avoid overflows later.

core/fxcodec/jbig2/JBig2_Image.h

Index: core/fxcodec/jbig2/JBig2_Image.h
diff --git a/core/fxcodec/jbig2/JBig2_Image.h b/core/fxcodec/jbig2/JBig2_Image.h
index a18a95d596029b64319e9f9612bd7007958f49c2..c723088cf799f9b7dc58fb60945332798c9ed2e3 100644
--- a/core/fxcodec/jbig2/JBig2_Image.h
+++ b/core/fxcodec/jbig2/JBig2_Image.h
@@ -9,6 +9,8 @@
 
 #include "core/fxcodec/jbig2/JBig2_Define.h"
 
+struct FX_RECT;
+
 enum JBig2ComposeOp {
   JBIG2_COMPOSE_OR = 0,
   JBIG2_COMPOSE_AND = 1,
@@ -17,23 +19,21 @@ enum JBig2ComposeOp {
   JBIG2_COMPOSE_REPLACE = 4
 };
 
-struct FX_RECT;
 class CJBig2_Image {
  public:
   CJBig2_Image(int32_t w, int32_t h);
-
   CJBig2_Image(int32_t w, int32_t h, int32_t stride, uint8_t* pBuf);
-
   CJBig2_Image(const CJBig2_Image& im);
-
   ~CJBig2_Image();
 
-  FX_BOOL getPixel(int32_t x, int32_t y);
+  int32_t width() const { return m_nWidth; }
+  int32_t height() const { return m_nHeight; }
+  int32_t stride() const { return m_nStride; }
 
+  FX_BOOL getPixel(int32_t x, int32_t y);
   int32_t setPixel(int32_t x, int32_t y, FX_BOOL v);
 
   void copyLine(int32_t hTo, int32_t hFrom);
-
   void fill(FX_BOOL v);
 
   FX_BOOL composeTo(CJBig2_Image* pDst,
@@ -67,18 +67,14 @@ class CJBig2_Image {
                       const FX_RECT* pSrcRect);
 
   CJBig2_Image* subImage(int32_t x, int32_t y, int32_t w, int32_t h);
-
   void expand(int32_t h, FX_BOOL v);
 
- public:
-  int32_t m_nWidth;
-
-  int32_t m_nHeight;
-
-  int32_t m_nStride;
-
   uint8_t* m_pData;
 
+ private:
+  int32_t m_nWidth;   // 1-bit pixels
+  int32_t m_nHeight;  // lines
+  int32_t m_nStride;  // bytes
   FX_BOOL m_bNeedFree;

[Lei Zhang, 2016/08/01 22:49:50]

const bool

[Tom Sepez, 2016/08/01 23:21:13]

Adding this "const" still compiles, but it shouldn't, since the 
expand() method, if implemented proplery, might have to change the setting when
it makes a new buffer.

But it's not implemented properly.

I think you can create an image w/ external buffer, and then expand it in the
h_direction, which might cause an alloc.  But it doesn't set the flag properly
in that case. Instead, it then causes realloc to be invoked on a the external
buffer, which may be non-heap memory.  Yay. 

Given this case, if it reallocs, we leak the newly returned buffer, and make the
caller's ptr invalid.

argh.

 };