Bail out on bad size and height in CCodec_FaxDecoder::CreateDecoder

core/fxcodec/codec/fx_codec_fax.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fxcodec/codec/codec_int.h"
 #include "core/fxcodec/include/fx_codec.h"
 
 namespace {
@@ skipping 18 matching lines @@
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
     0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
     1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
     1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1,
     2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2,
     2, 2, 2, 2, 2, 2, 2, 2, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3,
     4, 4, 4, 4, 4, 4, 4, 4, 5, 5, 5, 5, 6, 6, 7, 8,
 };
 
+// Limit of image dimension, an arbitrary large number.
+const int kMaxImageDimension = 0x01FFFF;
+
 int FindBit(const uint8_t* data_buf, int max_pos, int start_pos, int bit) {
+  ASSERT(start_pos >= 0);
   if (start_pos >= max_pos) {
     return max_pos;
   }
   const uint8_t* leading_pos = bit ? OneLeadPos : ZeroLeadPos;
   if (start_pos % 8) {
     uint8_t data = data_buf[start_pos / 8];
     if (bit) {
       data &= 0xff >> (start_pos % 8);
     } else {
       data |= 0xff << (8 - start_pos % 8);
@@ skipping 454 matching lines @@
   m_Encoding = K;
   m_bEndOfLine = EndOfLine;
   m_bByteAlign = EncodedByteAlign;
   m_bBlack = BlackIs1;
   m_OrigWidth = Columns;
   m_OrigHeight = Rows;
   if (m_OrigWidth == 0)
     m_OrigWidth = width;
   if (m_OrigHeight == 0)
     m_OrigHeight = height;
-  // Should not overflow. Checked by FPDFAPI_CreateFaxDecoder.
+  // Should not overflow. Checked by CCodec_FaxDecoder::CreateDecoder.
   m_Pitch = (static_cast<uint32_t>(m_OrigWidth) + 31) / 32 * 4;
   m_OutputWidth = m_OrigWidth;
   m_OutputHeight = m_OrigHeight;
   m_pScanlineBuf = FX_Alloc(uint8_t, m_Pitch);
   m_pRefBuf = FX_Alloc(uint8_t, m_Pitch);
   m_pSrcBuf = src_buf;
   m_SrcSize = src_size;
   m_nComps = 1;
   m_bpc = 1;
 }
@@ skipping 92 matching lines @@
     const uint8_t* src_buf,
     uint32_t src_size,
     int width,
     int height,
     int K,
     FX_BOOL EndOfLine,
     FX_BOOL EncodedByteAlign,
     FX_BOOL BlackIs1,
     int Columns,
     int Rows) {
+  // Reject invalid values.
+  if (width <= 0 || height < 0 || Columns < 0 || Rows < 0)
+    return nullptr;
+  // Reject unreasonable large input.
+  if (width > kMaxImageDimension || height > kMaxImageDimension ||
+      Columns > kMaxImageDimension || Rows > kMaxImageDimension)
+    return nullptr;
   return new CCodec_FaxDecoder(src_buf, src_size, width, height, K, EndOfLine,
                                EncodedByteAlign, BlackIs1, Columns, Rows);
 }