Strengthen bounds check in CWeightTable::Calc * part II

core/fxge/dib/fx_dib_engine.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include <limits.h>
 
 #include <algorithm>
 
@@ skipping 25 matching lines @@
     : m_DestMin(0),
       m_ItemSize(0),
       m_pWeightTables(nullptr),
       m_dwWeightTablesSize(0) {}
 
 CWeightTable::~CWeightTable() {
   FX_Free(m_pWeightTables);
 }
 
 size_t CWeightTable::GetPixelWeightSize() const {
-  return m_dwWeightTablesSize / sizeof(int);
+  return (m_ItemSize - sizeof(int) * 2) / sizeof(int);

[Lei Zhang, 2016/10/14 23:51:54]

How about: (m_ItemSize / sizeof(int)) - 2;

 }
 
 bool CWeightTable::Calc(int dest_len,
                         int dest_min,
                         int dest_max,
                         int src_len,
                         int src_min,
                         int src_max,
                         int flags) {
   FX_Free(m_pWeightTables);
@@ skipping 942 matching lines @@
                                   result_width);
     if (m_pMaskScanline) {
       m_pSource->m_pAlphaMask->DownSampleScanline(
           src_y, m_pMaskScanline.get(), 1, m_DestWidth, m_bFlipX,
           m_ClipRect.left, result_width);
     }
     m_pDest->ComposeScanline(dest_y, m_pScanline.get(), m_pMaskScanline.get());
   }
   return FALSE;
 }