Bail out on bad size and height in CCodec_FaxDecoder::CreateDecoder

core/fpdfapi/fpdf_parser/fpdf_parser_decode.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_parser/include/fpdf_parser_decode.h"
 
 #include <limits.h>
 #include <utility>
@@ skipping 230 matching lines @@
   if (pParams) {
     K = pParams->GetIntegerFor("K");
     EndOfLine = pParams->GetIntegerFor("EndOfLine");
     ByteAlign = pParams->GetIntegerFor("EncodedByteAlign");
     BlackIs1 = pParams->GetIntegerFor("BlackIs1");
     Columns = pParams->GetIntegerFor("Columns", 1728);
     Rows = pParams->GetIntegerFor("Rows");
     if (Rows > USHRT_MAX) {
       Rows = 0;
     }
-    if (Columns <= 0 || Rows < 0 || Columns > USHRT_MAX || Rows > USHRT_MAX) {
-      return nullptr;
-    }
   }
   return CPDF_ModuleMgr::Get()->GetFaxModule()->CreateDecoder(
       src_buf, src_size, width, height, K, EndOfLine, ByteAlign, BlackIs1,
       Columns, Rows);
 }
 
 static FX_BOOL CheckFlateDecodeParams(int Colors,
                                       int BitsPerComponent,
                                       int Columns) {
   if (Columns < 0) {
@@ skipping 308 matching lines @@
                      uint32_t src_size,
                      uint8_t*& dest_buf,
                      uint32_t& dest_size) {
   CCodec_ModuleMgr* pEncoders = CPDF_ModuleMgr::Get()->GetCodecModule();
   if (pEncoders) {
     return pEncoders->GetFlateModule()->FlateOrLZWDecode(
         FALSE, src_buf, src_size, FALSE, 0, 0, 0, 0, 0, dest_buf, dest_size);
   }
   return 0;
 }