Add bounds checks to CWeightTable::Calc() and friends.

core/fxge/dib/fx_dib_engine.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include <limits.h>
 
 #include <algorithm>
 
@@ skipping 14 matching lines @@
     return FXDIB_8bppMask;
   if (format == FXDIB_1bppRgb)
     return FXDIB_8bppRgb;
   if (format == FXDIB_8bppRgb && src.GetPalette())
     return FXDIB_Rgb;
   return format;
 }
 
 }  // namespace
 
-void CWeightTable::Calc(int dest_len,
+CWeightTable::CWeightTable()
+    : m_DestMin(0),
+      m_ItemSize(0),
+      m_pWeightTables(nullptr),
+      m_dwWeightTablesSize(0) {}
+
+CWeightTable::~CWeightTable() {
+  FX_Free(m_pWeightTables);
+}
+
+bool CWeightTable::Calc(int dest_len,
                         int dest_min,
                         int dest_max,
                         int src_len,
                         int src_min,
                         int src_max,
                         int flags) {
   FX_Free(m_pWeightTables);
   m_pWeightTables = nullptr;
-  double scale, base;
-  scale = (FX_FLOAT)src_len / (FX_FLOAT)dest_len;
-  if (dest_len < 0) {
-    base = (FX_FLOAT)(src_len);
-  } else {
-    base = 0;
-  }
-  int ext_size = flags & FXDIB_BICUBIC_INTERPOL ? 3 : 1;
+  m_dwWeightTablesSize = 0;
+  const double scale = (FX_FLOAT)src_len / (FX_FLOAT)dest_len;
+  const double base = dest_len < 0 ? (FX_FLOAT)(src_len) : 0;
+  const int ext_size = flags & FXDIB_BICUBIC_INTERPOL ? 3 : 1;
   m_ItemSize =
       sizeof(int) * 2 +
       (int)(sizeof(int) * (FXSYS_ceil(FXSYS_fabs((FX_FLOAT)scale)) + ext_size));
   m_DestMin = dest_min;
-  if ((dest_max - dest_min) > (int)((1U << 30) - 4) / m_ItemSize) {
-    return;
-  }
-  m_pWeightTables =
-      FX_TryAlloc(uint8_t, (dest_max - dest_min) * m_ItemSize + 4);
-  if (!m_pWeightTables) {
-    return;
-  }
+  if ((dest_max - dest_min) > (int)((1U << 30) - 4) / m_ItemSize)
+    return false;
+
+  m_dwWeightTablesSize = (dest_max - dest_min) * m_ItemSize + 4;
+  m_pWeightTables = FX_TryAlloc(uint8_t, m_dwWeightTablesSize);
+  if (!m_pWeightTables)
+    return false;
+
   if ((flags & FXDIB_NOSMOOTH) != 0 || FXSYS_fabs((FX_FLOAT)scale) < 1.0f) {
     for (int dest_pixel = dest_min; dest_pixel < dest_max; dest_pixel++) {
       PixelWeight& pixel_weights = *GetPixelWeight(dest_pixel);
       double src_pos = dest_pixel * scale + scale / 2 + base;
       if (flags & FXDIB_INTERPOL) {
         pixel_weights.m_SrcStart =
             (int)FXSYS_floor((FX_FLOAT)src_pos - 1.0f / 2);
         pixel_weights.m_SrcEnd = (int)FXSYS_floor((FX_FLOAT)src_pos + 1.0f / 2);
         if (pixel_weights.m_SrcStart < src_min) {
           pixel_weights.m_SrcStart = src_min;
@@ skipping 98 matching lines @@
             (int)FXSYS_floor((FX_FLOAT)src_pos);
         if (pixel_weights.m_SrcStart < src_min) {
           pixel_weights.m_SrcStart = src_min;
         }
         if (pixel_weights.m_SrcEnd >= src_max) {
           pixel_weights.m_SrcEnd = src_max - 1;
         }
         pixel_weights.m_Weights[0] = 65536;
       }
     }
-    return;
+    return true;
   }
+
   for (int dest_pixel = dest_min; dest_pixel < dest_max; dest_pixel++) {
     PixelWeight& pixel_weights = *GetPixelWeight(dest_pixel);
     double src_start = dest_pixel * scale + base;
     double src_end = src_start + scale;
     int start_i, end_i;
     if (src_start < src_end) {
       start_i = (int)FXSYS_floor((FX_FLOAT)src_start);
       end_i = (int)FXSYS_ceil((FX_FLOAT)src_end);
     } else {
       start_i = (int)FXSYS_floor((FX_FLOAT)src_end);
@@ skipping 27 matching lines @@
                               ? dest_start
                               : (FX_FLOAT)(dest_pixel);
       double area_end = dest_end > (FX_FLOAT)(dest_pixel + 1)
                             ? (FX_FLOAT)(dest_pixel + 1)
                             : dest_end;
       double weight = area_start >= area_end ? 0.0f : area_end - area_start;
       if (weight == 0 && j == end_i) {
         pixel_weights.m_SrcEnd--;
         break;
       }
-      pixel_weights.m_Weights[j - start_i] =
-          FXSYS_round((FX_FLOAT)(weight * 65536));
+      size_t idx = j - start_i;
+      if (idx >= m_dwWeightTablesSize)
+        return false;
+      pixel_weights.m_Weights[idx] = FXSYS_round((FX_FLOAT)(weight * 65536));
     }
   }
+  return true;
+}
+
+PixelWeight* CWeightTable::GetPixelWeight(int pixel) const {
+  ASSERT(pixel >= m_DestMin);
+  return reinterpret_cast<PixelWeight*>(m_pWeightTables +
+                                        (pixel - m_DestMin) * m_ItemSize);
+}
+
+int* CWeightTable::GetValueFromPixelWeight(PixelWeight* pWeight,
+                                           int index) const {
+  if (index < pWeight->m_SrcStart)
+    return nullptr;
+
+  size_t idx = index - pWeight->m_SrcStart;

[Tom Sepez, 2016/08/04 17:21:58]

Technically, this subtraction hits the same issue, but its too much work to make
it compliant, and works in practice.

[Tom Sepez, 2016/08/04 17:28:08]

NM, I thought you were subtracting pWeight, I should read closer.

+  return idx < m_dwWeightTablesSize ? &pWeight->m_Weights[idx] : nullptr;
 }
 
 CStretchEngine::CStretchEngine(IFX_ScanlineComposer* pDestBitmap,
                                FXDIB_Format dest_format,
                                int dest_width,
                                int dest_height,
                                const FX_RECT& clip_rect,
                                const CFX_DIBSource* pSrcBitmap,
                                int flags) {
   m_State = 0;
@@ skipping 133 matching lines @@
     return FALSE;
 
   if (m_pSource && m_bHasAlpha && m_pSource->m_pAlphaMask) {
     m_pExtraAlphaBuf =
         FX_Alloc2D(unsigned char, m_SrcClip.Height(), m_ExtraMaskPitch);
     uint32_t size = (m_DestClip.Width() * 8 + 31) / 32 * 4;
     m_pDestMaskScanline = FX_TryAlloc(unsigned char, size);
     if (!m_pDestMaskScanline)
       return FALSE;
   }
-  m_WeightTable.Calc(m_DestWidth, m_DestClip.left, m_DestClip.right, m_SrcWidth,
-                     m_SrcClip.left, m_SrcClip.right, m_Flags);
-  if (!m_WeightTable.m_pWeightTables)
+  bool ret =
+      m_WeightTable.Calc(m_DestWidth, m_DestClip.left, m_DestClip.right,
+                         m_SrcWidth, m_SrcClip.left, m_SrcClip.right, m_Flags);
+  if (!ret)
     return FALSE;
 
   m_CurRow = m_SrcClip.top;
   m_State = 1;
   return TRUE;
 }
 
 FX_BOOL CStretchEngine::ContinueStretchHorz(IFX_Pause* pPause) {
   if (!m_DestWidth)
     return FALSE;
@@ skipping 23 matching lines @@
           m_pExtraAlphaBuf + (m_CurRow - m_SrcClip.top) * m_ExtraMaskPitch;
     }
     switch (m_TransMethod) {
       case 1:
       case 2: {
         for (int col = m_DestClip.left; col < m_DestClip.right; col++) {
           PixelWeight* pPixelWeights = m_WeightTable.GetPixelWeight(col);
           int dest_a = 0;
           for (int j = pPixelWeights->m_SrcStart; j <= pPixelWeights->m_SrcEnd;
                j++) {
-            int pixel_weight =
-                pPixelWeights->m_Weights[j - pPixelWeights->m_SrcStart];
+            int* pWeight =
+                m_WeightTable.GetValueFromPixelWeight(pPixelWeights, j);
+            if (!pWeight)
+              return FALSE;
+
+            int pixel_weight = *pWeight;
             if (src_scan[j / 8] & (1 << (7 - j % 8))) {
               dest_a += pixel_weight * 255;
             }
           }
           if (m_Flags & FXDIB_BICUBIC_INTERPOL) {
             dest_a = dest_a < 0 ? 0 : dest_a > 16711680 ? 16711680 : dest_a;
           }
           *dest_scan++ = (uint8_t)(dest_a >> 16);
         }
         break;
       }
       case 3: {
         for (int col = m_DestClip.left; col < m_DestClip.right; col++) {
           PixelWeight* pPixelWeights = m_WeightTable.GetPixelWeight(col);
           int dest_a = 0;
           for (int j = pPixelWeights->m_SrcStart; j <= pPixelWeights->m_SrcEnd;
                j++) {
-            int pixel_weight =
-                pPixelWeights->m_Weights[j - pPixelWeights->m_SrcStart];
+            int* pWeight =
+                m_WeightTable.GetValueFromPixelWeight(pPixelWeights, j);
+            if (!pWeight)
+              return FALSE;
+
+            int pixel_weight = *pWeight;
             dest_a += pixel_weight * src_scan[j];
           }
           if (m_Flags & FXDIB_BICUBIC_INTERPOL) {
             dest_a = dest_a < 0 ? 0 : dest_a > 16711680 ? 16711680 : dest_a;
           }
           *dest_scan++ = (uint8_t)(dest_a >> 16);
         }
         break;
       }
       case 4: {
         for (int col = m_DestClip.left; col < m_DestClip.right; col++) {
           PixelWeight* pPixelWeights = m_WeightTable.GetPixelWeight(col);
           int dest_a = 0, dest_r = 0;
           for (int j = pPixelWeights->m_SrcStart; j <= pPixelWeights->m_SrcEnd;
                j++) {
-            int pixel_weight =
-                pPixelWeights->m_Weights[j - pPixelWeights->m_SrcStart];
+            int* pWeight =
+                m_WeightTable.GetValueFromPixelWeight(pPixelWeights, j);
+            if (!pWeight)
+              return FALSE;
+
+            int pixel_weight = *pWeight;
             pixel_weight = pixel_weight * src_scan_mask[j] / 255;
             dest_r += pixel_weight * src_scan[j];
             dest_a += pixel_weight;
           }
           if (m_Flags & FXDIB_BICUBIC_INTERPOL) {
             dest_r = dest_r < 0 ? 0 : dest_r > 16711680 ? 16711680 : dest_r;
             dest_a = dest_a < 0 ? 0 : dest_a > 65536 ? 65536 : dest_a;
           }
           *dest_scan++ = (uint8_t)(dest_r >> 16);
           *dest_scan_mask++ = (uint8_t)((dest_a * 255) >> 16);
         }
         break;
       }
       case 5: {
         for (int col = m_DestClip.left; col < m_DestClip.right; col++) {
           PixelWeight* pPixelWeights = m_WeightTable.GetPixelWeight(col);
           int dest_r_y = 0, dest_g_m = 0, dest_b_c = 0;
           for (int j = pPixelWeights->m_SrcStart; j <= pPixelWeights->m_SrcEnd;
                j++) {
-            int pixel_weight =
-                pPixelWeights->m_Weights[j - pPixelWeights->m_SrcStart];
+            int* pWeight =
+                m_WeightTable.GetValueFromPixelWeight(pPixelWeights, j);
+            if (!pWeight)
+              return FALSE;
+
+            int pixel_weight = *pWeight;
             unsigned long argb_cmyk = m_pSrcPalette[src_scan[j]];
             if (m_DestFormat == FXDIB_Rgb) {
               dest_r_y += pixel_weight * (uint8_t)(argb_cmyk >> 16);
               dest_g_m += pixel_weight * (uint8_t)(argb_cmyk >> 8);
               dest_b_c += pixel_weight * (uint8_t)argb_cmyk;
             } else {
               dest_b_c += pixel_weight * (uint8_t)(argb_cmyk >> 24);
               dest_g_m += pixel_weight * (uint8_t)(argb_cmyk >> 16);
               dest_r_y += pixel_weight * (uint8_t)(argb_cmyk >> 8);
             }
@@ skipping 11 matching lines @@
           *dest_scan++ = (uint8_t)(dest_r_y >> 16);
         }
         break;
       }
       case 6: {
         for (int col = m_DestClip.left; col < m_DestClip.right; col++) {
           PixelWeight* pPixelWeights = m_WeightTable.GetPixelWeight(col);
           int dest_a = 0, dest_r_y = 0, dest_g_m = 0, dest_b_c = 0;
           for (int j = pPixelWeights->m_SrcStart; j <= pPixelWeights->m_SrcEnd;
                j++) {
-            int pixel_weight =
-                pPixelWeights->m_Weights[j - pPixelWeights->m_SrcStart];
+            int* pWeight =
+                m_WeightTable.GetValueFromPixelWeight(pPixelWeights, j);
+            if (!pWeight)
+              return FALSE;
+
+            int pixel_weight = *pWeight;
             pixel_weight = pixel_weight * src_scan_mask[j] / 255;
             unsigned long argb_cmyk = m_pSrcPalette[src_scan[j]];
             if (m_DestFormat == FXDIB_Rgba) {
               dest_r_y += pixel_weight * (uint8_t)(argb_cmyk >> 16);
               dest_g_m += pixel_weight * (uint8_t)(argb_cmyk >> 8);
               dest_b_c += pixel_weight * (uint8_t)argb_cmyk;
             } else {
               dest_b_c += pixel_weight * (uint8_t)(argb_cmyk >> 24);
               dest_g_m += pixel_weight * (uint8_t)(argb_cmyk >> 16);
               dest_r_y += pixel_weight * (uint8_t)(argb_cmyk >> 8);
@@ skipping 15 matching lines @@
           *dest_scan_mask++ = (uint8_t)((dest_a * 255) >> 16);
         }
         break;
       }
       case 7: {
         for (int col = m_DestClip.left; col < m_DestClip.right; col++) {
           PixelWeight* pPixelWeights = m_WeightTable.GetPixelWeight(col);
           int dest_r_y = 0, dest_g_m = 0, dest_b_c = 0;
           for (int j = pPixelWeights->m_SrcStart; j <= pPixelWeights->m_SrcEnd;
                j++) {
-            int pixel_weight =
-                pPixelWeights->m_Weights[j - pPixelWeights->m_SrcStart];
+            int* pWeight =
+                m_WeightTable.GetValueFromPixelWeight(pPixelWeights, j);
+            if (!pWeight)
+              return FALSE;
+
+            int pixel_weight = *pWeight;
             const uint8_t* src_pixel = src_scan + j * Bpp;
             dest_b_c += pixel_weight * (*src_pixel++);
             dest_g_m += pixel_weight * (*src_pixel++);
             dest_r_y += pixel_weight * (*src_pixel);
           }
           if (m_Flags & FXDIB_BICUBIC_INTERPOL) {
             dest_b_c =
                 dest_b_c < 0 ? 0 : dest_b_c > 16711680 ? 16711680 : dest_b_c;
             dest_g_m =
                 dest_g_m < 0 ? 0 : dest_g_m > 16711680 ? 16711680 : dest_g_m;
             dest_r_y =
                 dest_r_y < 0 ? 0 : dest_r_y > 16711680 ? 16711680 : dest_r_y;
           }
           *dest_scan++ = (uint8_t)((dest_b_c) >> 16);
           *dest_scan++ = (uint8_t)((dest_g_m) >> 16);
           *dest_scan++ = (uint8_t)((dest_r_y) >> 16);
           dest_scan += Bpp - 3;
         }
         break;
       }
       case 8: {
         for (int col = m_DestClip.left; col < m_DestClip.right; col++) {
           PixelWeight* pPixelWeights = m_WeightTable.GetPixelWeight(col);
           int dest_a = 0, dest_r_y = 0, dest_g_m = 0, dest_b_c = 0;
           for (int j = pPixelWeights->m_SrcStart; j <= pPixelWeights->m_SrcEnd;
                j++) {
-            int pixel_weight =
-                pPixelWeights->m_Weights[j - pPixelWeights->m_SrcStart];
+            int* pWeight =
+                m_WeightTable.GetValueFromPixelWeight(pPixelWeights, j);
+            if (!pWeight)
+              return FALSE;
+
+            int pixel_weight = *pWeight;
             const uint8_t* src_pixel = src_scan + j * Bpp;
             if (m_DestFormat == FXDIB_Argb) {
               pixel_weight = pixel_weight * src_pixel[3] / 255;
             } else {
               pixel_weight = pixel_weight * src_scan_mask[j] / 255;
             }
             dest_b_c += pixel_weight * (*src_pixel++);
             dest_g_m += pixel_weight * (*src_pixel++);
             dest_r_y += pixel_weight * (*src_pixel);
             dest_a += pixel_weight;
@@ skipping 24 matching lines @@
     rows_to_go--;
   }
   return FALSE;
 }
 
 void CStretchEngine::StretchVert() {
   if (m_DestHeight == 0)
     return;
 
   CWeightTable table;
-  table.Calc(m_DestHeight, m_DestClip.top, m_DestClip.bottom, m_SrcHeight,
-             m_SrcClip.top, m_SrcClip.bottom, m_Flags);
-  if (!table.m_pWeightTables)
+  bool ret = table.Calc(m_DestHeight, m_DestClip.top, m_DestClip.bottom,
+                        m_SrcHeight, m_SrcClip.top, m_SrcClip.bottom, m_Flags);
+  if (!ret)
     return;
 
-  int DestBpp = m_DestBpp / 8;
+  const int DestBpp = m_DestBpp / 8;
   for (int row = m_DestClip.top; row < m_DestClip.bottom; row++) {
     unsigned char* dest_scan = m_pDestScanline;
-    unsigned char* dest_sacn_mask = m_pDestMaskScanline;
+    unsigned char* dest_scan_mask = m_pDestMaskScanline;
     PixelWeight* pPixelWeights = table.GetPixelWeight(row);
     switch (m_TransMethod) {
       case 1:
       case 2:
       case 3: {
         for (int col = m_DestClip.left; col < m_DestClip.right; col++) {
           unsigned char* src_scan =
               m_pInterBuf + (col - m_DestClip.left) * DestBpp;
           int dest_a = 0;
           for (int j = pPixelWeights->m_SrcStart; j <= pPixelWeights->m_SrcEnd;
                j++) {
-            int pixel_weight =
-                pPixelWeights->m_Weights[j - pPixelWeights->m_SrcStart];
+            int* pWeight = table.GetValueFromPixelWeight(pPixelWeights, j);
+            if (!pWeight)
+              return;
+
+            int pixel_weight = *pWeight;
             dest_a +=
                 pixel_weight * src_scan[(j - m_SrcClip.top) * m_InterPitch];
           }
           if (m_Flags & FXDIB_BICUBIC_INTERPOL) {
             dest_a = dest_a < 0 ? 0 : dest_a > 16711680 ? 16711680 : dest_a;
           }
           *dest_scan = (uint8_t)(dest_a >> 16);
           dest_scan += DestBpp;
         }
         break;
       }
       case 4: {
         for (int col = m_DestClip.left; col < m_DestClip.right; col++) {
           unsigned char* src_scan =
               m_pInterBuf + (col - m_DestClip.left) * DestBpp;
           unsigned char* src_scan_mask =
               m_pExtraAlphaBuf + (col - m_DestClip.left);
           int dest_a = 0, dest_k = 0;
           for (int j = pPixelWeights->m_SrcStart; j <= pPixelWeights->m_SrcEnd;
                j++) {
-            int pixel_weight =
-                pPixelWeights->m_Weights[j - pPixelWeights->m_SrcStart];
+            int* pWeight = table.GetValueFromPixelWeight(pPixelWeights, j);
+            if (!pWeight)
+              return;
+
+            int pixel_weight = *pWeight;
             dest_k +=
                 pixel_weight * src_scan[(j - m_SrcClip.top) * m_InterPitch];
             dest_a += pixel_weight *
                       src_scan_mask[(j - m_SrcClip.top) * m_ExtraMaskPitch];
           }
           if (m_Flags & FXDIB_BICUBIC_INTERPOL) {
             dest_k = dest_k < 0 ? 0 : dest_k > 16711680 ? 16711680 : dest_k;
             dest_a = dest_a < 0 ? 0 : dest_a > 16711680 ? 16711680 : dest_a;
           }
           *dest_scan = (uint8_t)(dest_k >> 16);
           dest_scan += DestBpp;
-          *dest_sacn_mask++ = (uint8_t)(dest_a >> 16);
+          *dest_scan_mask++ = (uint8_t)(dest_a >> 16);
         }
         break;
       }
       case 5:
       case 7: {
         for (int col = m_DestClip.left; col < m_DestClip.right; col++) {
           unsigned char* src_scan =
               m_pInterBuf + (col - m_DestClip.left) * DestBpp;
           int dest_r_y = 0, dest_g_m = 0, dest_b_c = 0;
           for (int j = pPixelWeights->m_SrcStart; j <= pPixelWeights->m_SrcEnd;
                j++) {
-            int pixel_weight =
-                pPixelWeights->m_Weights[j - pPixelWeights->m_SrcStart];
+            int* pWeight = table.GetValueFromPixelWeight(pPixelWeights, j);
+            if (!pWeight)
+              return;
+
+            int pixel_weight = *pWeight;
             const uint8_t* src_pixel =
                 src_scan + (j - m_SrcClip.top) * m_InterPitch;
             dest_b_c += pixel_weight * (*src_pixel++);
             dest_g_m += pixel_weight * (*src_pixel++);
             dest_r_y += pixel_weight * (*src_pixel);
           }
           if (m_Flags & FXDIB_BICUBIC_INTERPOL) {
             dest_r_y =
                 dest_r_y < 0 ? 0 : dest_r_y > 16711680 ? 16711680 : dest_r_y;
             dest_g_m =
@@ skipping 13 matching lines @@
         for (int col = m_DestClip.left; col < m_DestClip.right; col++) {
           unsigned char* src_scan =
               m_pInterBuf + (col - m_DestClip.left) * DestBpp;
           unsigned char* src_scan_mask = nullptr;
           if (m_DestFormat != FXDIB_Argb) {
             src_scan_mask = m_pExtraAlphaBuf + (col - m_DestClip.left);
           }
           int dest_a = 0, dest_r_y = 0, dest_g_m = 0, dest_b_c = 0;
           for (int j = pPixelWeights->m_SrcStart; j <= pPixelWeights->m_SrcEnd;
                j++) {
-            int pixel_weight =
-                pPixelWeights->m_Weights[j - pPixelWeights->m_SrcStart];
+            int* pWeight = table.GetValueFromPixelWeight(pPixelWeights, j);
+            if (!pWeight)
+              return;
+
+            int pixel_weight = *pWeight;
             const uint8_t* src_pixel =
                 src_scan + (j - m_SrcClip.top) * m_InterPitch;
             int mask_v = 255;
             if (src_scan_mask) {
               mask_v = src_scan_mask[(j - m_SrcClip.top) * m_ExtraMaskPitch];
             }
             dest_b_c += pixel_weight * (*src_pixel++);
             dest_g_m += pixel_weight * (*src_pixel++);
             dest_r_y += pixel_weight * (*src_pixel);
             if (m_DestFormat == FXDIB_Argb) {
@@ skipping 15 matching lines @@
             int r = ((uint32_t)dest_r_y) * 255 / dest_a;
             int g = ((uint32_t)dest_g_m) * 255 / dest_a;
             int b = ((uint32_t)dest_b_c) * 255 / dest_a;
             dest_scan[0] = b > 255 ? 255 : b < 0 ? 0 : b;
             dest_scan[1] = g > 255 ? 255 : g < 0 ? 0 : g;
             dest_scan[2] = r > 255 ? 255 : r < 0 ? 0 : r;
           }
           if (m_DestFormat == FXDIB_Argb) {
             dest_scan[3] = (uint8_t)((dest_a) >> 16);
           } else {
-            *dest_sacn_mask = (uint8_t)((dest_a) >> 16);
+            *dest_scan_mask = (uint8_t)((dest_a) >> 16);
           }
           dest_scan += DestBpp;
-          if (dest_sacn_mask) {
-            dest_sacn_mask++;
+          if (dest_scan_mask) {
+            dest_scan_mask++;
           }
         }
         break;
       }
     }
     m_pDestBitmap->ComposeScanline(row - m_DestClip.top, m_pDestScanline,
                                    m_pDestMaskScanline);
   }
 }
 
@@ skipping 140 matching lines @@
                                   result_width);
     if (m_pMaskScanline) {
       m_pSource->m_pAlphaMask->DownSampleScanline(
           src_y, m_pMaskScanline.get(), 1, m_DestWidth, m_bFlipX,
           m_ClipRect.left, result_width);
     }
     m_pDest->ComposeScanline(dest_y, m_pScanline.get(), m_pMaskScanline.get());
   }
   return FALSE;
 }