Fix uninitialized coords and one of infinite loops

core/src/fpdfapi/fpdf_render/fpdf_render_pattern.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fpdfapi/fpdf_render.h"
 #include "../../../include/fpdfapi/fpdf_pageobj.h"
 #include "../../../include/fxge/fx_ge.h"
 #include "../fpdf_page/pageint.h"
@@ skipping 645 matching lines @@
                 left *= 2;
                 bottom *= 2;
                 Draw(x_scale, y_scale, left, bottom, C1.first_half(), m1f, D1.first_half(), m2f);
                 Draw(x_scale, y_scale, left, bottom + 1, m1f, C2.first_half(), D1.second_half(), m2s);
                 Draw(x_scale, y_scale, left + 1, bottom, C1.second_half(), m1s, m2f, D2.first_half());
                 Draw(x_scale, y_scale, left + 1, bottom + 1, m1s, C2.second_half(), m2s, D2.second_half());
             }
         }
     }
 };
+
+FX_BOOL _CheckCoonTensorPara(CPDF_MeshStream &stream)

[Tom Sepez, 2014/07/14 21:38:01]

nit: static

[Tom Sepez, 2014/07/15 18:27:25]

nit: const CPDF_MeshStream&

+{
+    FX_BOOL bCoorBits = ( stream.m_nCoordBits== 1  ||

[Tom Sepez, 2014/07/14 21:38:01]

nit: space before ==

+                          stream.m_nCoordBits == 2  ||
+                          stream.m_nCoordBits == 4  ||
+                          stream.m_nCoordBits == 8  ||
+                          stream.m_nCoordBits == 12 ||
+                          stream.m_nCoordBits == 16 ||
+                          stream.m_nCoordBits == 24 ||
+                          stream.m_nCoordBits == 32  );
+
+    FX_BOOL bCompBits = ( stream.m_nCompBits == 1  || 
+                          stream.m_nCompBits == 2  ||
+                          stream.m_nCompBits == 4  ||
+                          stream.m_nCompBits == 8  ||
+                          stream.m_nCompBits == 12 ||
+                          stream.m_nCompBits == 16  );
+
+    FX_BOOL bFlagBits = ( stream.m_nFlagBits == 2  ||
+                          stream.m_nFlagBits == 4  ||
+                          stream.m_nFlagBits == 8   );
+
+    return bCoorBits && bCompBits && bFlagBits; 
+}
+
 static void _DrawCoonPatchMeshes(FX_BOOL bTensor, CFX_DIBitmap* pBitmap, CFX_AffineMatrix* pObject2Bitmap,
                                  CPDF_Stream* pShadingStream, CPDF_Function** pFuncs, int nFuncs,
                                  CPDF_ColorSpace* pCS, int fill_mode, int alpha)
 {
     ASSERT(pBitmap->GetFormat() == FXDIB_Argb);
     if (pShadingStream->GetType() != PDFOBJ_STREAM) {
         return;
     }
     CFX_FxgeDevice device;
     device.Attach(pBitmap);
     CPDF_MeshStream stream;
     if (!stream.Load(pShadingStream, pFuncs, nFuncs, pCS)) {
         return;
     }
+
+    if (!_CheckCoonTensorPara(stream))

[Tom Sepez, 2014/07/14 21:38:01]

nit: { } per other tests that just return in this function.

+        return;
+ 
     CPDF_PatchDrawer patch;
     patch.alpha = alpha;
     patch.pDevice = &device;
     patch.fill_mode = fill_mode;
     patch.path.SetPointCount(13);
     FX_PATHPOINT* pPoints = patch.path.GetPoints();
     pPoints[0].m_Flag = FXPT_MOVETO;
     for (int i = 1; i < 13; i ++) {
         pPoints[i].m_Flag = FXPT_BEZIERTO;
     }
     CFX_FloatPoint coords[16];
+    for(FX_DWORD i = 0; i < 16; i++)
+    {

[Tom Sepez, 2014/07/15 18:35:45]

nit: brace on previous line to match style.

+        coords[i].x = 0.0;
+        coords[i].y = 0.0;
+    }
+
     int point_count = bTensor ? 16 : 12;
     while (!stream.m_BitStream.IsEOF()) {
         FX_DWORD flag = stream.GetFlag();
         int iStartPoint = 0, iStartColor = 0, i;
         if (flag) {
             iStartPoint = 4;
             iStartColor = 2;
             CFX_FloatPoint tempCoords[4];
             for (int i = 0; i < 4; i ++) {

[Tom Sepez, 2014/07/15 18:35:45]

nit: this declaration of i shadows an outer one at line 730, and can be removed,
using the outer one.

                 tempCoords[i] = coords[(flag * 3 + i) % 12];
             }
             FXSYS_memcpy32(coords, tempCoords, sizeof(CFX_FloatPoint) * 4);
             Coon_Color tempColors[2];
             tempColors[0] = patch.patch_colors[flag];
             tempColors[1] = patch.patch_colors[(flag + 1) % 4];
             FXSYS_memcpy32(patch.patch_colors, tempColors, sizeof(Coon_Color) * 2);
         }
         for (i = iStartPoint; i < point_count; i ++) {
             stream.GetCoords(coords[i].x, coords[i].y);
@@ skipping 374 matching lines @@
             bStroke = FALSE;
             bPattern = TRUE;
         }
     }
 #ifdef _FPDFAPI_MINI_
     if (bPattern && m_DitherBits) {
         DitherObjectArea(pPathObj, pObj2Device);
     }
 #endif
 }