Verify row bytes before alloc in BMP codec.

core/fxcodec/lbmp/fx_bmp.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fxcodec/lbmp/fx_bmp.h"
 
 #include <algorithm>
 
@@ skipping 195 matching lines @@
       case 24:
         bmp_ptr->out_row_bytes = BMP_WIDTHBYTES(bmp_ptr->width, 24);
         bmp_ptr->components = 3;
         break;
       case 32:
         bmp_ptr->out_row_bytes = bmp_ptr->src_row_bytes;
         bmp_ptr->components = 4;
         break;
     }
     FX_Free(bmp_ptr->out_row_buffer);
+
+    if (bmp_ptr->out_row_bytes <= 0) {
+      bmp_error(bmp_ptr, "The Bmp File Is Corrupt");
+      return 0;
+    }
+
     bmp_ptr->out_row_buffer = FX_Alloc(uint8_t, bmp_ptr->out_row_bytes);
     FXSYS_memset(bmp_ptr->out_row_buffer, 0, bmp_ptr->out_row_bytes);
     bmp_save_decoding_status(bmp_ptr, BMP_D_STATUS_PAL);
   }
   if (bmp_ptr->decode_status == BMP_D_STATUS_PAL) {
     skip_size_org = bmp_ptr->skip_size;
     if (bmp_ptr->compress_flag == BMP_BITFIELDS) {
       if (bmp_ptr->bitCounts != 16 && bmp_ptr->bitCounts != 32) {
         bmp_error(bmp_ptr, "The Bmp File Is Corrupt");
         return 0;
@@ skipping 698 matching lines @@
     case BMP_RLE4:
       bmp_encode_rle4(bmp_ptr, dst_buf, dst_size);
       break;
     default:
       break;
   }
   bmp_ptr->file_header.bfSize = dst_size;
   WriteFileHeader(&bmp_ptr->file_header, dst_buf);
   return TRUE;
 }