Strengthen bounds check in CWeightTable::Calc * part II

core/fxge/dib/fx_dib_engine.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include <limits.h>
 
 #include <algorithm>
 
@@ skipping 24 matching lines @@
 CWeightTable::CWeightTable()
     : m_DestMin(0),
       m_ItemSize(0),
       m_pWeightTables(nullptr),
       m_dwWeightTablesSize(0) {}
 
 CWeightTable::~CWeightTable() {
   FX_Free(m_pWeightTables);
 }
 
-size_t CWeightTable::GetPixelWeightSize() const {
-  return m_dwWeightTablesSize / sizeof(int);

[Lei Zhang, 2016/10/10 18:30:51]

Should we instead just check for:

return m_ItemSize / sizeof(int);

??

+size_t CWeightTable::GetMaximumPixelWeightSize(PixelWeight* pWeight) const {
+  uint8_t* end_addr = m_pWeightTables + m_dwWeightTablesSize;
+  uint8_t* begin_addr = reinterpret_cast<uint8_t*>(&pWeight->m_Weights);
+  return (end_addr - begin_addr) / sizeof(pWeight->m_Weights[0]);
 }
 
 bool CWeightTable::Calc(int dest_len,
                         int dest_min,
                         int dest_max,
                         int src_len,
                         int src_min,
                         int src_max,
                         int flags) {
   FX_Free(m_pWeightTables);
@@ skipping 176 matching lines @@
                               : (FX_FLOAT)(dest_pixel);
       double area_end = dest_end > (FX_FLOAT)(dest_pixel + 1)
                             ? (FX_FLOAT)(dest_pixel + 1)
                             : dest_end;
       double weight = area_start >= area_end ? 0.0f : area_end - area_start;
       if (weight == 0 && j == end_i) {
         pixel_weights.m_SrcEnd--;
         break;
       }
       size_t idx = j - start_i;
-      if (idx >= GetPixelWeightSize())
+      if (idx >= GetMaximumPixelWeightSize(&pixel_weights))
         return false;
       pixel_weights.m_Weights[idx] = FXSYS_round((FX_FLOAT)(weight * 65536));
     }
   }
   return true;
 }
 
 PixelWeight* CWeightTable::GetPixelWeight(int pixel) const {
   ASSERT(pixel >= m_DestMin);
   return reinterpret_cast<PixelWeight*>(m_pWeightTables +
                                         (pixel - m_DestMin) * m_ItemSize);
 }
 
 int* CWeightTable::GetValueFromPixelWeight(PixelWeight* pWeight,
                                            int index) const {
   if (index < pWeight->m_SrcStart)
     return nullptr;
 
   size_t idx = index - pWeight->m_SrcStart;
-  return idx < GetPixelWeightSize() ? &pWeight->m_Weights[idx] : nullptr;
+  return idx < GetMaximumPixelWeightSize(pWeight) ? &pWeight->m_Weights[idx] : nullptr;
 }
 
 CStretchEngine::CStretchEngine(IFX_ScanlineComposer* pDestBitmap,
                                FXDIB_Format dest_format,
                                int dest_width,
                                int dest_height,
                                const FX_RECT& clip_rect,
                                const CFX_DIBSource* pSrcBitmap,
                                int flags) {
   m_State = 0;
@@ skipping 725 matching lines @@
                                   result_width);
     if (m_pMaskScanline) {
       m_pSource->m_pAlphaMask->DownSampleScanline(
           src_y, m_pMaskScanline.get(), 1, m_DestWidth, m_bFlipX,
           m_ClipRect.left, result_width);
     }
     m_pDest->ComposeScanline(dest_y, m_pScanline.get(), m_pMaskScanline.get());
   }
   return FALSE;
 }