Fix assertion failure when decoding malform G4 fax image

core/fxcodec/codec/fx_codec_fax.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include <algorithm>
 #include <vector>
 
 #include "core/fxcodec/codec/codec_int.h"
@@ skipping 372 matching lines @@
         }
       }
     }
     a1 = b1 + v_delta;
     if (!a0color)
       FaxFillBits(dest_buf, columns, a0, a1);
 
     if (a1 >= columns)
       return TRUE;
 
+    // The position of picture element must be monotonic increasing.
+    if (a0 >= a1)
+      return FALSE;
+
     a0 = a1;
     a0color = !a0color;
   }
 }
 
 FX_BOOL FaxSkipEOL(const uint8_t* src_buf, int bitsize, int* bitpos) {
   int startbit = *bitpos;
   while (*bitpos < bitsize) {
     int bit = NEXTBIT();
     if (!bit)
@@ skipping 199 matching lines @@
     return nullptr;
 
   // Reject unreasonable large input.
   if (actual_width > kMaxImageDimension || actual_height > kMaxImageDimension)
     return nullptr;
 
   uint32_t pitch = (static_cast<uint32_t>(actual_width) + 31) / 32 * 4;
   return new CCodec_FaxDecoder(src_buf, src_size, actual_width, actual_height,
                                pitch, K, EndOfLine, EncodedByteAlign, BlackIs1);
 }