Verify number of ex flags matches number of ex items.

core/fxcodec/jbig2/JBig2_SddProc.cpp

 // Copyright 2015 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fxcodec/jbig2/JBig2_SddProc.h"
 
 #include <memory>
 #include <vector>
@@ skipping 231 matching lines @@
       goto failed;
     }
     if (EXRUNLENGTH != 0) {
       for (I = EXINDEX; I < EXINDEX + EXRUNLENGTH; I++) {
         EXFLAGS[I] = CUREXFLAG;
       }
     }
     EXINDEX = EXINDEX + EXRUNLENGTH;
     CUREXFLAG = !CUREXFLAG;
   }
+  if (EXINDEX > SDNUMEXSYMS) {

[Tom Sepez, 2016/10/12 16:27:43]

This is fine, but generally when writing this "C-Style" error handling, I like
to null out my pointers out top, then always delete them at |failed:|.  Then you
don't have to remember to do this before each |goto failed|

[kcwu, 2016/10/12 16:41:47]

Since SDNUMEXSYMS is always zero, this check means rejecting EXINDEX > 0. I
don't know what these variables are but I feel this seems too aggressive.

I'd suggest do more tests if possible before commit.

[kcwu, 2016/10/12 23:49:58]

So, please ignore my previous stupid comment.

+    FX_Free(EXFLAGS);
+    goto failed;
+  }
+
   pDict.reset(new CJBig2_SymbolDict);
   I = J = 0;
   for (I = 0; I < SDNUMINSYMS + SDNUMNEWSYMS; I++) {
     if (EXFLAGS[I] && J < SDNUMEXSYMS) {
       if (I < SDNUMINSYMS) {
         pDict->AddImage(SDINSYMS[I] ? new CJBig2_Image(*SDINSYMS[I]) : nullptr);
       } else {
         pDict->AddImage(SDNEWSYMS[I - SDNUMINSYMS]);
       }
       ++J;
@@ skipping 303 matching lines @@
       goto failed;
     }
     if (EXRUNLENGTH != 0) {
       for (I = EXINDEX; I < EXINDEX + EXRUNLENGTH; I++) {
         EXFLAGS[I] = CUREXFLAG;
       }
     }
     EXINDEX = EXINDEX + EXRUNLENGTH;
     CUREXFLAG = !CUREXFLAG;
   }
+  if (EXINDEX > SDNUMEXSYMS) {

[kcwu, 2016/10/12 23:49:58]

As your commit message said, it will leak if the number of EXFLAGS[]==true is
more than SDNUMEXSYMS. But why do you check EXINDEX > SDNUMEXSYMS here?

EXINDEX includes both 0 and 1 since CUREXFLAG is flipped for each run.

[dsinclair, 2016/10/13 14:12:17]

Ack, good point. Fixed.

+    FX_Free(EXFLAGS);
+    goto failed;
+  }
+
   I = J = 0;
   for (I = 0; I < SDNUMINSYMS + SDNUMNEWSYMS; I++) {
     if (EXFLAGS[I] && J < SDNUMEXSYMS) {
       if (I < SDNUMINSYMS) {
         pDict->AddImage(SDINSYMS[I] ? new CJBig2_Image(*SDINSYMS[I]) : nullptr);
       } else {
         pDict->AddImage(SDNEWSYMS[I - SDNUMINSYMS]);
       }
       ++J;
     } else if (!EXFLAGS[I] && I >= SDNUMINSYMS) {
       delete SDNEWSYMS[I - SDNUMINSYMS];
     }
   }
   FX_Free(EXFLAGS);
   FX_Free(SDNEWSYMS);
   if (SDREFAGG == 0) {
     FX_Free(SDNEWSYMWIDTHS);
   }
   return pDict.release();
 failed:
   for (I = 0; I < NSYMSDECODED; I++) {
     delete SDNEWSYMS[I];
   }
   FX_Free(SDNEWSYMS);
   if (SDREFAGG == 0) {
     FX_Free(SDNEWSYMWIDTHS);
   }
   return nullptr;
 }