Bail out on negative a0 values in FaxG4GetRow().

core/fxcodec/codec/fx_codec_fax.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fxcodec/codec/codec_int.h"
 #include "core/fxcodec/include/fx_codec.h"
 
 namespace {
@@ skipping 319 matching lines @@
           run_len2 += run;
           if (run < 64) {
             break;
           }
         }
         a2 = a1 + run_len2;
         if (a0color) {
           FaxFillBits(dest_buf, columns, a1, a2);
         }
         a0 = a2;
-        if (a0 < columns) {
-          continue;
-        }
-        return TRUE;
+        if (a0 < 0 && a0 >= columns)
+          return TRUE;
+        continue;
       } else {
         if (bitpos >= bitsize) {
           return FALSE;
         }
         bit = NEXTBIT;
         if (bit) {
           if (!a0color) {
             FaxFillBits(dest_buf, columns, a0, b2);
           }
-          if (b2 >= columns) {
+          a0 = b2;
+          if (a0 < 0 || a0 >= columns)
             return TRUE;
-          }
-          a0 = b2;
           continue;
         } else {
           if (bitpos >= bitsize) {
             return FALSE;
           }
           FX_BOOL next_bit1 = NEXTBIT;
           if (bitpos >= bitsize) {
             return FALSE;
           }
           FX_BOOL next_bit2 = NEXTBIT;
@@ skipping 24 matching lines @@
               return TRUE;
             }
           }
         }
       }
     }
     a1 = b1 + v_delta;
     if (!a0color) {
       FaxFillBits(dest_buf, columns, a0, a1);
     }
-    if (a1 >= columns) {
+    a0 = a1;
+    if (a0 < 0 || a0 >= columns)
       return TRUE;
-    }
-    a0 = a1;
     a0color = !a0color;
   }
 }
 
 FX_BOOL FaxSkipEOL(const uint8_t* src_buf, int bitsize, int& bitpos) {
   int startbit = bitpos;
   while (bitpos < bitsize) {
     int bit = NEXTBIT;
     if (bit) {
       if (bitpos - startbit <= 11) {
@@ skipping 205 matching lines @@
     int height,
     int K,
     FX_BOOL EndOfLine,
     FX_BOOL EncodedByteAlign,
     FX_BOOL BlackIs1,
     int Columns,
     int Rows) {
   return new CCodec_FaxDecoder(src_buf, src_size, width, height, K, EndOfLine,
                                EncodedByteAlign, BlackIs1, Columns, Rows);
 }