Strengthen bounds check in CWeightTable::Calc.

core/fxge/dib/fx_dib_engine.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include <limits.h>
 
 #include <algorithm>
 
@@ skipping 45 matching lines @@
   const int ext_size = flags & FXDIB_BICUBIC_INTERPOL ? 3 : 1;
   m_ItemSize =
       sizeof(int) * 2 +
       (int)(sizeof(int) * (FXSYS_ceil(FXSYS_fabs((FX_FLOAT)scale)) + ext_size));
   m_DestMin = dest_min;
   if ((dest_max - dest_min) > (int)((1U << 30) - 4) / m_ItemSize)
     return false;
 
   m_dwWeightTablesSize = (dest_max - dest_min) * m_ItemSize + 4;
   m_pWeightTables = FX_TryAlloc(uint8_t, m_dwWeightTablesSize);
+  m_dwWeightTablesSize /= sizeof(int);

[Lei Zhang, 2016/09/23 21:32:01]

I think it's weird for a variable to have 2 different units. Maybe add a helper
method to return m_dwWeightTablesSize / sizeof(int), and use that where
appropriate.

   if (!m_pWeightTables)
     return false;
 
   if ((flags & FXDIB_NOSMOOTH) != 0 || FXSYS_fabs((FX_FLOAT)scale) < 1.0f) {
     for (int dest_pixel = dest_min; dest_pixel < dest_max; dest_pixel++) {
       PixelWeight& pixel_weights = *GetPixelWeight(dest_pixel);
       double src_pos = dest_pixel * scale + scale / 2 + base;
       if (flags & FXDIB_INTERPOL) {
         pixel_weights.m_SrcStart =
             (int)FXSYS_floor((FX_FLOAT)src_pos - 1.0f / 2);
@@ skipping 918 matching lines @@
                                   result_width);
     if (m_pMaskScanline) {
       m_pSource->m_pAlphaMask->DownSampleScanline(
           src_y, m_pMaskScanline.get(), 1, m_DestWidth, m_bFlipX,
           m_ClipRect.left, result_width);
     }
     m_pDest->ComposeScanline(dest_y, m_pScanline.get(), m_pMaskScanline.get());
   }
   return FALSE;
 }