Strengthen bounds check in CWeightTable::Calc.

Strengthen bounds check in CWeightTable::Calc.

The buffer PixelWeight.m_Weights was allocated by calling FX_TryAlloc(uint8_t, m_dwWeightTablesSize),
but PixelWeight.m_Weights was an int array. Thus bounds check such as |if (idx >= m_dwWeightTablesSize)|
 in function CWeightTable::Calc() and |idx < m_dwWeightTablesSize ? &pWeight->m_Weights[idx] : nullptr|
 in function CWeightTable::GetValueFromPixelWeight() were insufficient.

This CL strengthens bounds check for accessing int type array PixelWeight.m_Weights.

BUG=chromium:619398
R=ochang@chromium.org, thestig@chromium.org

Committed: https://pdfium.googlesource.com/pdfium/+/5aed0216ad6574944e76a95ef0dbbc910bab4a1a

[Ke Liu, 2016-09-08 08:06:42]

Description was changed from

==========
Strengthen bounds check in CWeightTable::Calc.

The buffer PixelWeight.m_Weights was allocated by calling FX_TryAlloc(uint8_t,
m_dwWeightTablesSize),
but PixelWeight.m_Weights was an int array. Thus bounds check such as |if (idx
>= m_dwWeightTablesSize)|
 in function CWeightTable::Calc() and |idx < m_dwWeightTablesSize ?
&pWeight->m_Weights[idx] : nullptr|
 in function CWeightTable::GetValueFromPixelWeight() were insufficient.

This CL strengthens bounds check for accessing int array PixelWeight.m_Weights.

BUG=chromium:619398
R=ochang@chromium.org
==========

to

==========
Strengthen bounds check in CWeightTable::Calc.

The buffer PixelWeight.m_Weights was allocated by calling FX_TryAlloc(uint8_t,
m_dwWeightTablesSize),
but PixelWeight.m_Weights was an int array. Thus bounds check such as |if (idx
>= m_dwWeightTablesSize)|
 in function CWeightTable::Calc() and |idx < m_dwWeightTablesSize ?
&pWeight->m_Weights[idx] : nullptr|
 in function CWeightTable::GetValueFromPixelWeight() were insufficient.

This CL strengthens bounds check for accessing int array PixelWeight.m_Weights.

BUG=chromium:619398
R=ochang@chromium.org
==========

[Ke Liu, 2016-09-08 08:06:42]

stackexploit@gmail.com changed reviewers:
+ thestig@chromium.org

[Ke Liu, 2016-09-08 08:08:54]

On 2016/09/08 07:09:57, Ke Liu wrote:

Add thestig as a reviewer since he uploaded
https://codereview.chromium.org/2204773003/

[Lei Zhang, 2016-09-23 21:32:01]

https://codereview.chromium.org/2322903002/diff/1/core/fxge/dib/fx_dib_engine...
File core/fxge/dib/fx_dib_engine.cpp (right):

https://codereview.chromium.org/2322903002/diff/1/core/fxge/dib/fx_dib_engine...
core/fxge/dib/fx_dib_engine.cpp:66: m_dwWeightTablesSize /= sizeof(int);
I think it's weird for a variable to have 2 different units. Maybe add a helper
method to return m_dwWeightTablesSize / sizeof(int), and use that where
appropriate.

[Lei Zhang, 2016-09-23 21:32:44]

The CQ bit was checked by thestig@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-09-23 21:32:54]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-09-23 21:54:24]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-09-23 21:54:25]

Dry run: This issue passed the CQ dry run.

[Ke Liu, 2016-09-26 08:29:20]

The CQ bit was checked by stackexploit@gmail.com to run a CQ dry run

[commit-bot: I haz the power, 2016-09-26 08:29:28]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-09-26 08:29:30]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-09-26 08:29:31]

Dry run: No L-G-T-M from a valid reviewer yet. 
CQ run can only be started by full committers or once the patch has
received an L-G-T-M from a full committer.
Even if an L-G-T-M may have been provided, it was from a non-committer,
_not_ a full super star committer.
Committers are members of the group "project-pdfium-committers".
Note that this has nothing to do with OWNERS files.

[Ke Liu, 2016-09-26 08:32:37]

On 2016/09/23 21:32:01, Lei Zhang wrote:
>
https://codereview.chromium.org/2322903002/diff/1/core/fxge/dib/fx_dib_engine...
> File core/fxge/dib/fx_dib_engine.cpp (right):
> 
>
https://codereview.chromium.org/2322903002/diff/1/core/fxge/dib/fx_dib_engine...
> core/fxge/dib/fx_dib_engine.cpp:66: m_dwWeightTablesSize /= sizeof(int);
> I think it's weird for a variable to have 2 different units. Maybe add a
helper
> method to return m_dwWeightTablesSize / sizeof(int), and use that where
> appropriate.

Thanks. I've added a method GetPixelWeightSize for CWeightTable now.

[Ke Liu, 2016-09-26 13:06:13]

Description was changed from

==========
Strengthen bounds check in CWeightTable::Calc.

The buffer PixelWeight.m_Weights was allocated by calling FX_TryAlloc(uint8_t,
m_dwWeightTablesSize),
but PixelWeight.m_Weights was an int array. Thus bounds check such as |if (idx
>= m_dwWeightTablesSize)|
 in function CWeightTable::Calc() and |idx < m_dwWeightTablesSize ?
&pWeight->m_Weights[idx] : nullptr|
 in function CWeightTable::GetValueFromPixelWeight() were insufficient.

This CL strengthens bounds check for accessing int array PixelWeight.m_Weights.

BUG=chromium:619398
R=ochang@chromium.org
==========

to

==========
Strengthen bounds check in CWeightTable::Calc.

The buffer PixelWeight.m_Weights was allocated by calling FX_TryAlloc(uint8_t,
m_dwWeightTablesSize),
but PixelWeight.m_Weights was an int array. Thus bounds check such as |if (idx
>= m_dwWeightTablesSize)|
 in function CWeightTable::Calc() and |idx < m_dwWeightTablesSize ?
&pWeight->m_Weights[idx] : nullptr|
 in function CWeightTable::GetValueFromPixelWeight() were insufficient.

This CL strengthens bounds check for accessing int type array
PixelWeight.m_Weights.

BUG=chromium:619398
R=ochang@chromium.org, thestig@chromium.org
==========

[Lei Zhang, 2016-09-26 20:41:57]

The CQ bit was checked by thestig@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-09-26 20:42:00]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-09-26 20:52:11]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-09-26 20:52:11]

Dry run: This issue passed the CQ dry run.

[Lei Zhang, 2016-09-26 20:54:33]

The CQ bit was checked by thestig@chromium.org

[Lei Zhang, 2016-09-26 20:54:34]

lgtm

[commit-bot: I haz the power, 2016-09-26 20:54:41]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-09-26 20:54:59]

Description was changed from

==========
Strengthen bounds check in CWeightTable::Calc.

The buffer PixelWeight.m_Weights was allocated by calling FX_TryAlloc(uint8_t,
m_dwWeightTablesSize),
but PixelWeight.m_Weights was an int array. Thus bounds check such as |if (idx
>= m_dwWeightTablesSize)|
 in function CWeightTable::Calc() and |idx < m_dwWeightTablesSize ?
&pWeight->m_Weights[idx] : nullptr|
 in function CWeightTable::GetValueFromPixelWeight() were insufficient.

This CL strengthens bounds check for accessing int type array
PixelWeight.m_Weights.

BUG=chromium:619398
R=ochang@chromium.org, thestig@chromium.org
==========

to

==========
Strengthen bounds check in CWeightTable::Calc.

The buffer PixelWeight.m_Weights was allocated by calling FX_TryAlloc(uint8_t,
m_dwWeightTablesSize),
but PixelWeight.m_Weights was an int array. Thus bounds check such as |if (idx
>= m_dwWeightTablesSize)|
 in function CWeightTable::Calc() and |idx < m_dwWeightTablesSize ?
&pWeight->m_Weights[idx] : nullptr|
 in function CWeightTable::GetValueFromPixelWeight() were insufficient.

This CL strengthens bounds check for accessing int type array
PixelWeight.m_Weights.

BUG=chromium:619398
R=ochang@chromium.org, thestig@chromium.org

Committed:
https://pdfium.googlesource.com/pdfium/+/5aed0216ad6574944e76a95ef0dbbc910bab...
==========

[commit-bot: I haz the power, 2016-09-26 20:55:00]

Committed patchset #2 (id:20001) as
https://pdfium.googlesource.com/pdfium/+/5aed0216ad6574944e76a95ef0dbbc910bab...