Fix compare between signed and unsigned values in CPDF_ImageRenderer::StartDIBSource.

core/fpdfapi/fpdf_render/fpdf_render_image.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_render/render_int.h"
 
 #include <memory>
 #include <utility>
@@ skipping 744 matching lines @@
     }
   }
   m_pRenderStatus->m_pDevice->SetDIBitsWithBlend(
       bitmap_device1.GetBitmap(), rect.left, rect.top, m_BlendType);
 #endif  //  _SKIA_SUPPORT_
   return FALSE;
 }
 
 FX_BOOL CPDF_ImageRenderer::StartDIBSource() {
   if (!(m_Flags & RENDER_FORCE_DOWNSAMPLE) && m_pDIBSource->GetBPP() > 1) {
-    int image_size = m_pDIBSource->GetBPP() / 8 * m_pDIBSource->GetWidth() *
-                     m_pDIBSource->GetHeight();
-    if (image_size > FPDF_HUGE_IMAGE_SIZE &&
+    FX_SAFE_SIZE_T image_size = m_pDIBSource->GetBPP() / 8 * m_pDIBSource->GetWidth() *

[Oliver Chang, 2016/09/12 16:21:33]

This is incorrect, as any integer errors would've already occurred by the time
you assign to image_size.

You need to do something like:

FX_SAFE_SIZE_T image_size = m_pDIBSource->GetBPP();
image_size /= 8;
image_size *= m_pDIBSource->GetWidth();
...

+        m_pDIBSource->GetHeight();
+    if (image_size.ValueOrDie() > FPDF_HUGE_IMAGE_SIZE &&

[Oliver Chang, 2016/09/12 16:21:33]

Usually we don't want to crash if image_size is not valid. The convention is to
do something like:

if (!image_size.IsValid())
  return FALSE;

         !(m_Flags & RENDER_FORCE_HALFTONE)) {
       m_Flags |= RENDER_FORCE_DOWNSAMPLE;
     }
   }
 #ifdef _SKIA_SUPPORT_
   CFX_DIBitmap* premultiplied = m_pDIBSource->Clone();
   if (m_pDIBSource->HasAlpha())
     CFX_SkiaDeviceDriver::PreMultiply(premultiplied);
   if (m_pRenderStatus->m_pDevice->StartDIBitsWithBlend(
           premultiplied, m_BitmapAlpha, m_FillArgb, &m_ImageMatrix, m_Flags,
@@ skipping 292 matching lines @@
   } else if (pFunc) {
     int size = dest_pitch * height;
     for (int i = 0; i < size; i++) {
       dest_buf[i] = transfers[src_buf[i]];
     }
   } else {
     FXSYS_memcpy(dest_buf, src_buf, dest_pitch * height);
   }
   return pMask.release();
 }