Fix a crasher issue due to invalid 'bits per component' in PDF

core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fxge/fx_ge.h"
 #include "../../../include/fxcodec/fx_codec.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fpdfapi/fpdf_render.h"
@@ skipping 893 matching lines @@
                 }
                 m_pColorSpace->GetRGB(temp_buf, R, G, B);
                 FX_Free(temp_buf);
             } else {
                 m_pColorSpace->GetRGB(color_value, R, G, B);
             }
             SetPaletteArgb(i, ArgbEncode(255, FXSYS_round(R * 255), FXSYS_round(G * 255), FXSYS_round(B * 255)));
         }
     }
 }
-FX_DWORD CPDF_DIBSource::GetValidBpp() const
+FX_DWORD CPDF_DIBSource::GetValidBpc() const
 {
     FX_DWORD bpc = m_bpc;
     CPDF_Object * pFilter = m_pDict->GetElementValue(FX_BSTRC("Filter"));
     if (pFilter) {
         if (pFilter->GetType() == PDFOBJ_NAME) {
             CFX_ByteString filter = pFilter->GetString();
             if (filter == FX_BSTRC("CCITTFaxDecode") || filter == FX_BSTRC("JBIG2Decode")) {
                 bpc = 1;
             }
             if (filter == FX_BSTRC("RunLengthDecode") || filter == FX_BSTRC("DCTDecode")) {
@@ skipping 33 matching lines @@
                 FX_LPCBYTE src_pos = src_scan;
                 for (int column = 0; column < m_Width; column ++) {
                     *dest_scan++ = src_pos[2];
                     *dest_scan++ = src_pos[1];
                     *dest_scan++ = *src_pos;
                     src_pos += 3;
                 }
             } else {
                 int src_bit_pos = 0;
                 int dest_byte_pos = 0;
-                FX_DWORD bpc = GetValidBpp();
+                FX_DWORD bpc = GetValidBpc();
                 for (int column = 0; column < m_Width; column ++) {
                     int R = _GetBits8(src_scan, src_bit_pos, bpc);
                     src_bit_pos += bpc;
                     int G = _GetBits8(src_scan, src_bit_pos, bpc);
                     src_bit_pos += bpc;
                     int B = _GetBits8(src_scan, src_bit_pos, bpc);
                     src_bit_pos += bpc;
                     R = NORMALCOLOR_MAX(R, max_data);
                     G = NORMALCOLOR_MAX(G, max_data);
                     B = NORMALCOLOR_MAX(B, max_data);
@@ skipping 35 matching lines @@
             G = NORMALCOLOR_MAX(G, 1);
             B = NORMALCOLOR_MAX(B, 1);
             dest_scan[dest_byte_pos] = (FX_INT32)(B * 255);
             dest_scan[dest_byte_pos + 1] = (FX_INT32)(G * 255);
             dest_scan[dest_byte_pos + 2] = (FX_INT32)(R * 255);
             dest_byte_pos += 3;
         }
     } else {
         int src_bit_pos = 0;
         int dest_byte_pos = 0;
-        FX_DWORD bpc = GetValidBpp();
+        FX_DWORD bpc = GetValidBpc();
         for (int column = 0; column < m_Width; column ++) {
             for (FX_DWORD color = 0; color < m_nComponents; color ++) {
                 int data = _GetBits8(src_scan, src_bit_pos, bpc);
                 color_values[color] = m_pCompData[color].m_DecodeMin +
                                       m_pCompData[color].m_DecodeStep * data;
                 src_bit_pos += bpc;
             }
             if (m_bLoadMask && m_GroupFamily == PDFCS_DEVICECMYK && m_Family == PDFCS_DEVICECMYK) {
                 FX_FLOAT k = 1.0f - color_values[3];
                 R = (1.0f - color_values[0]) * k;
@@ skipping 142 matching lines @@
 FX_BOOL CPDF_DIBSource::SkipToScanline(int line, IFX_Pause* pPause) const
 {
     if (m_pDecoder) {
         return m_pDecoder->SkipToScanline(line, pPause);
     }
     return FALSE;
 }
 void CPDF_DIBSource::DownSampleScanline(int line, FX_LPBYTE dest_scan, int dest_bpp,
                                         int dest_width, FX_BOOL bFlipX, int clip_left, int clip_width) const
 {
+    FX_DWORD bpc = GetValidBpc();
     FX_DWORD src_width = m_Width;
-    FX_DWORD src_pitch = (src_width * m_bpc * m_nComponents + 7) / 8;
+    FX_DWORD src_pitch = (src_width * bpc * m_nComponents + 7) / 8;

[palmer, 2014/07/07 19:36:04]

All the arithmetic in this function looks dangerous. Can you explain why it's
safe, or use CheckedNumeric?

[jun_fang, 2014/07/07 21:14:08]

This fix is used for that crashing issue. I already noticed the arithmetic in
this function is not safe. I suggest to raise another but to track it. It is
clearer than fixing two issues in a bug.

     FX_LPCBYTE pSrcLine = NULL;
     if (m_pCachedBitmap) {
         pSrcLine = m_pCachedBitmap->GetScanline(line);
     } else if (m_pDecoder) {
         pSrcLine = m_pDecoder->GetScanline(line);
     } else {
         if (m_pStreamAcc->GetSize() >= (line + 1) * src_pitch) {
             pSrcLine = m_pStreamAcc->GetData() + line * src_pitch;
         }
     }
-    int orig_Bpp = m_bpc * m_nComponents / 8;
+    int orig_Bpp = bpc * m_nComponents / 8;
     int dest_Bpp = dest_bpp / 8;
     if (pSrcLine == NULL) {
         FXSYS_memset32(dest_scan, 0xff, dest_Bpp * clip_width);
         return;
     }
     CFX_FixedBufGrow<FX_BYTE, 128> temp(orig_Bpp);
-    if (m_bpc * m_nComponents == 1) {
+    if (bpc * m_nComponents == 1) {
         FX_DWORD set_argb = (FX_DWORD) - 1, reset_argb = 0;
         if (m_bImageMask) {
             if (m_bDefaultDecode) {
                 set_argb = 0;
                 reset_argb = (FX_DWORD) - 1;
             }
         } else if (m_bColorKey) {
             reset_argb = m_pPalette ? m_pPalette[0] : 0xff000000;
             set_argb = m_pPalette ? m_pPalette[1] : 0xffffffff;
             if (m_pCompData[0].m_ColorKeyMin == 0) {
@@ skipping 47 matching lines @@
                 } else if (dest_Bpp == 3) {
                     dest_scan[dest_pos] = FXARGB_B(reset_argb);
                     dest_scan[dest_pos + 1] = FXARGB_G(reset_argb);
                     dest_scan[dest_pos + 2] = FXARGB_R(reset_argb);
                 } else {
                     *(FX_DWORD*)(dest_scan + dest_pos) = reset_argb;
                 }
             }
         }
         return;
-    } else if (m_bpc * m_nComponents <= 8) {
-        if (m_bpc < 8) {
+    } else if (bpc * m_nComponents <= 8) {
+        if (bpc < 8) {
             int src_bit_pos = 0;
             for (FX_DWORD col = 0; col < src_width; col ++) {
                 int color_index = 0;
                 for (FX_DWORD color = 0; color < m_nComponents; color ++) {
-                    int data = _GetBits8(pSrcLine, src_bit_pos, m_bpc);
-                    color_index |= data << (color * m_bpc);
-                    src_bit_pos += m_bpc;
+                    int data = _GetBits8(pSrcLine, src_bit_pos, bpc);
+                    color_index |= data << (color * bpc);
+                    src_bit_pos += bpc;
                 }
                 m_pLineBuf[col] = color_index;
             }
             pSrcLine = m_pLineBuf;
         }
         if (m_bColorKey) {
             for (int i = 0; i < clip_width; i ++) {
                 FX_DWORD src_x = (clip_left + i) * src_width / dest_width;
                 if (bFlipX) {
                     src_x = src_width - src_x - 1;
@@ skipping 28 matching lines @@
                 FX_ARGB argb = m_pPalette[index];
                 dest_scan[dest_pos] = FXARGB_B(argb);
                 dest_scan[dest_pos + 1] = FXARGB_G(argb);
                 dest_scan[dest_pos + 2] = FXARGB_R(argb);
             }
         }
         return;
     } else {
         int last_src_x = -1;
         FX_ARGB last_argb;
-        FX_FLOAT orig_Not8Bpp = (FX_FLOAT)m_bpc * (FX_FLOAT)m_nComponents / 8.0f;
-        FX_FLOAT unit_To8Bpc = 255.0f / ((1 << m_bpc) - 1);
+        FX_FLOAT orig_Not8Bpp = (FX_FLOAT)bpc * (FX_FLOAT)m_nComponents / 8.0f;
+        FX_FLOAT unit_To8Bpc = 255.0f / ((1 << bpc) - 1);
         for (int i = 0; i < clip_width; i ++) {
             int dest_x = clip_left + i;
             FX_DWORD src_x = (bFlipX ? (dest_width - dest_x - 1) : dest_x) * (FX_INT64)src_width / dest_width;
             src_x %= src_width;
             FX_LPCBYTE pSrcPixel = NULL;
-            if (m_bpc % 8 == 0) {
+            if (bpc % 8 == 0) {
                 pSrcPixel = pSrcLine + src_x * orig_Bpp;
             } else {
                 pSrcPixel = pSrcLine + (int)(src_x * orig_Not8Bpp);
             }
             FX_LPBYTE pDestPixel = dest_scan + i * dest_Bpp;
             FX_ARGB argb;
             if (src_x == last_src_x) {
                 argb = last_argb;
             } else {
                 if (m_pColorSpace) {
                     FX_BYTE color[4];
                     if (!m_bDefaultDecode) {
                         for (int i = 0; i < orig_Bpp; i ++) {
                             int color_value = (int)((m_pCompData[i].m_DecodeMin + m_pCompData[i].m_DecodeStep * (FX_FLOAT)pSrcPixel[i]) * 255.0f + 0.5f);
                             temp[i] = color_value > 255 ? 255 : (color_value < 0 ? 0 : color_value);
                         }
                         m_pColorSpace->TranslateImageLine(color, temp, 1, 0, 0, m_bLoadMask && m_GroupFamily == PDFCS_DEVICECMYK && m_Family == PDFCS_DEVICECMYK);
                     } else {
-                        if (m_bpc < 8) {
+                        if (bpc < 8) {
                             int src_bit_pos = 0;
                             if (src_x % 2) {
                                 src_bit_pos = 4;
                             }
-                            int value = (1 << m_bpc)  - 1;
+                            int value = (1 << bpc)  - 1;
                             for (FX_DWORD i = 0; i < m_nComponents; i ++) {
-                                temp[i] = (FX_BYTE)(_GetBits8(pSrcPixel, src_bit_pos, m_bpc) * unit_To8Bpc);
-                                src_bit_pos += m_bpc;
+                                temp[i] = (FX_BYTE)(_GetBits8(pSrcPixel, src_bit_pos, bpc) * unit_To8Bpc);
+                                src_bit_pos += bpc;
                             }
                             m_pColorSpace->TranslateImageLine(color, temp, 1, 0, 0, m_bLoadMask && m_GroupFamily == PDFCS_DEVICECMYK && m_Family == PDFCS_DEVICECMYK);
                         } else {
                             m_pColorSpace->TranslateImageLine(color, pSrcPixel, 1, 0, 0, m_bLoadMask && m_GroupFamily == PDFCS_DEVICECMYK && m_Family == PDFCS_DEVICECMYK);
                         }
                     }
                     argb = FXARGB_MAKE(0xff, color[2], color[1], color[0]);
                 } else {
                     argb = FXARGB_MAKE(0xff, pSrcPixel[2], pSrcPixel[1], pSrcPixel[0]);
                 }
                 if (m_bColorKey) {
                     int alpha = 0xff;
-                    if (m_nComponents == 3 && m_bpc == 8) {
+                    if (m_nComponents == 3 && bpc == 8) {
                         alpha = (pSrcPixel[0] < m_pCompData[0].m_ColorKeyMin ||
                                  pSrcPixel[0] > m_pCompData[0].m_ColorKeyMax ||
                                  pSrcPixel[1] < m_pCompData[1].m_ColorKeyMin ||
                                  pSrcPixel[1] > m_pCompData[1].m_ColorKeyMax ||
                                  pSrcPixel[2] < m_pCompData[2].m_ColorKeyMin ||
                                  pSrcPixel[2] > m_pCompData[2].m_ColorKeyMax) ? 0xff : 0;
                     }
                     argb &= 0xffffff;
                     argb |= alpha << 24;
                 }
@@ skipping 118 matching lines @@
     if (!m_bCached) {
         if (m_pBitmap) {
             delete m_pBitmap;
             m_pBitmap = NULL;
         }
         if (m_pMask) {
             delete m_pMask;
         }
     }
 }