[M53] Bound total pixels in JBig2 images to avoid overflows later.

core/fxcodec/jbig2/JBig2_Context.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fxcodec/jbig2/JBig2_Context.h"
 
 #include <algorithm>
 #include <list>
@@ skipping 921 matching lines @@
     pSegment->m_Result.im =
         pTRD->decode_Huffman(m_pStream.get(), grContext.get());
     if (!pSegment->m_Result.im)
       return JBIG2_ERROR_FATAL;
     m_pStream->alignByte();
   }
   if (pSegment->m_cFlags.s.type != 4) {
     if (!m_bBufSpecified) {
       JBig2PageInfo* pPageInfo = m_PageInfoList.back();
       if ((pPageInfo->m_bIsStriped == 1) &&
-          (ri.y + ri.height > m_pPage->m_nHeight)) {
+          (ri.y + ri.height > m_pPage->height())) {
         m_pPage->expand(ri.y + ri.height, (pPageInfo->m_cFlags & 4) ? 1 : 0);
       }
     }
     m_pPage->composeFrom(ri.x, ri.y, pSegment->m_Result.im,
                          (JBig2ComposeOp)(ri.flags & 0x03));
     delete pSegment->m_Result.im;
     pSegment->m_Result.im = nullptr;
   }
   return JBIG2_SUCCESS;
 }
@@ skipping 70 matching lines @@
       findSegmentByNumber(pSegment->m_pReferred_to_segment_numbers[0]);
   if (!pSeg || (pSeg->m_cFlags.s.type != 16))
     return JBIG2_ERROR_FATAL;
 
   CJBig2_PatternDict* pPatternDict = pSeg->m_Result.pd;
   if (!pPatternDict || (pPatternDict->NUMPATS == 0))
     return JBIG2_ERROR_FATAL;
 
   pHRD->HNUMPATS = pPatternDict->NUMPATS;
   pHRD->HPATS = pPatternDict->HDPATS;
-  pHRD->HPW = pPatternDict->HDPATS[0]->m_nWidth;
-  pHRD->HPH = pPatternDict->HDPATS[0]->m_nHeight;
+  pHRD->HPW = pPatternDict->HDPATS[0]->width();
+  pHRD->HPH = pPatternDict->HDPATS[0]->height();
   pSegment->m_nResultType = JBIG2_IMAGE_POINTER;
   if (pHRD->HMMR == 0) {
     const size_t size = GetHuffContextSize(pHRD->HTEMPLATE);
     std::unique_ptr<JBig2ArithCtx, FxFreeDeleter> gbContext(
         FX_Alloc(JBig2ArithCtx, size));
     JBIG2_memset(gbContext.get(), 0, sizeof(JBig2ArithCtx) * size);
     std::unique_ptr<CJBig2_ArithDecoder> pArithDecoder(
         new CJBig2_ArithDecoder(m_pStream.get()));
     pSegment->m_Result.im =
         pHRD->decode_Arith(pArithDecoder.get(), gbContext.get(), pPause);
     if (!pSegment->m_Result.im)
       return JBIG2_ERROR_FATAL;
 
     m_pStream->alignByte();
     m_pStream->offset(2);
   } else {
     pSegment->m_Result.im = pHRD->decode_MMR(m_pStream.get(), pPause);
     if (!pSegment->m_Result.im)
       return JBIG2_ERROR_FATAL;
     m_pStream->alignByte();
   }
   if (pSegment->m_cFlags.s.type != 20) {
     if (!m_bBufSpecified) {
       JBig2PageInfo* pPageInfo = m_PageInfoList.back();
       if (pPageInfo->m_bIsStriped == 1 &&
-          ri.y + ri.height > m_pPage->m_nHeight) {
+          ri.y + ri.height > m_pPage->height()) {
         m_pPage->expand(ri.y + ri.height, (pPageInfo->m_cFlags & 4) ? 1 : 0);
       }
     }
     m_pPage->composeFrom(ri.x, ri.y, pSegment->m_Result.im,
                          (JBig2ComposeOp)(ri.flags & 0x03));
     delete pSegment->m_Result.im;
     pSegment->m_Result.im = nullptr;
   }
   return JBIG2_SUCCESS;
 }
@@ skipping 45 matching lines @@
       m_ProcessingStatus = m_pGRD->Start_decode_Arith(
           &pSegment->m_Result.im, m_pArithDecoder.get(), m_gbContext, pPause);
     } else {
       m_ProcessingStatus = m_pGRD->Continue_decode(pPause);
     }
     if (m_ProcessingStatus == FXCODEC_STATUS_DECODE_TOBECONTINUE) {
       if (pSegment->m_cFlags.s.type != 36) {
         if (!m_bBufSpecified) {
           JBig2PageInfo* pPageInfo = m_PageInfoList.back();
           if ((pPageInfo->m_bIsStriped == 1) &&
-              (m_ri.y + m_ri.height > m_pPage->m_nHeight)) {
+              (m_ri.y + m_ri.height > m_pPage->height())) {
             m_pPage->expand(m_ri.y + m_ri.height,
                             (pPageInfo->m_cFlags & 4) ? 1 : 0);
           }
         }
         FX_RECT Rect = m_pGRD->GetReplaceRect();
         m_pPage->composeFrom(m_ri.x + Rect.left, m_ri.y + Rect.top,
                              pSegment->m_Result.im,
                              (JBig2ComposeOp)(m_ri.flags & 0x03), &Rect);
       }
       return JBIG2_SUCCESS;
@@ skipping 14 matching lines @@
     if (!pSegment->m_Result.im) {
       m_pGRD.reset();
       return JBIG2_ERROR_FATAL;
     }
     m_pStream->alignByte();
   }
   if (pSegment->m_cFlags.s.type != 36) {
     if (!m_bBufSpecified) {
       JBig2PageInfo* pPageInfo = m_PageInfoList.back();
       if ((pPageInfo->m_bIsStriped == 1) &&
-          (m_ri.y + m_ri.height > m_pPage->m_nHeight)) {
+          (m_ri.y + m_ri.height > m_pPage->height())) {
         m_pPage->expand(m_ri.y + m_ri.height,
                         (pPageInfo->m_cFlags & 4) ? 1 : 0);
       }
     }
     FX_RECT Rect = m_pGRD->GetReplaceRect();
     m_pPage->composeFrom(m_ri.x + Rect.left, m_ri.y + Rect.top,
                          pSegment->m_Result.im,
                          (JBig2ComposeOp)(m_ri.flags & 0x03), &Rect);
     delete pSegment->m_Result.im;
     pSegment->m_Result.im = nullptr;
@@ skipping 52 matching lines @@
   pSegment->m_Result.im = pGRRD->decode(pArithDecoder.get(), grContext.get());
   if (!pSegment->m_Result.im)
     return JBIG2_ERROR_FATAL;
 
   m_pStream->alignByte();
   m_pStream->offset(2);
   if (pSegment->m_cFlags.s.type != 40) {
     if (!m_bBufSpecified) {
       JBig2PageInfo* pPageInfo = m_PageInfoList.back();
       if ((pPageInfo->m_bIsStriped == 1) &&
-          (ri.y + ri.height > m_pPage->m_nHeight)) {
+          (ri.y + ri.height > m_pPage->height())) {
         m_pPage->expand(ri.y + ri.height, (pPageInfo->m_cFlags & 4) ? 1 : 0);
       }
     }
     m_pPage->composeFrom(ri.x, ri.y, pSegment->m_Result.im,
                          (JBig2ComposeOp)(ri.flags & 0x03));
     delete pSegment->m_Result.im;
     pSegment->m_Result.im = nullptr;
   }
   return JBIG2_SUCCESS;
 }
@@ skipping 157 matching lines @@
         SBSYMCODES[CURTEMP].code = CURCODE;
         CURCODE = CURCODE + 1;
       }
       CURTEMP = CURTEMP + 1;
     }
     CURLEN = CURLEN + 1;
   }
   FX_Free(LENCOUNT);
   FX_Free(FIRSTCODE);
 }