Fix buffer size offset error in PNG_Predictor

core/src/fxcodec/codec/fx_codec_flate.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../fx_zlib.h"
 #include "../../../include/fxcodec/fx_codec.h"
 #include "codec_int.h"
 extern "C"
@@ skipping 391 matching lines @@
             int move_size = row_size;
             if ((row + 1) * (move_size + 1) > (int)data_size) {
                 move_size = last_row_size - 1;
             }
             FXSYS_memmove32(pDestData, pSrcData + 1, move_size);
             pSrcData += move_size + 1;
             pDestData += move_size;
             byte_cnt += move_size + 1;
             continue;
         }
+        byte_cnt++;

[Tom Sepez, 2014/08/15 16:51:30]

nit: As I read this, it would make more sense to me to put this at line 401,
right after the reference to srcData[0].  After all, it is the use of that byte
as a tag that is causing the need to increment the byte_cnt.  Keeping them
together might make this more obvious.

[Bo Xu, 2014/08/15 18:08:10]

If put byte_cnt++ on line 401, then when tag==0, line 409 has already increment
byte_cnt by an offset of 1, so it will be effectively an offset of 2. I think
then we have to do 
            byte_cnt += move_size
in line 409, right?

On 2014/08/15 16:51:30, Tom Sepez wrote:

[Tom Sepez, 2014/08/15 19:02:12]

Yep. Good catch.

         for (int byte = 0; byte < row_size && byte_cnt < (int)data_size; byte ++) {
             FX_BYTE raw_byte = pSrcData[byte + 1];
             switch (tag) {
                 case 1: {
                         FX_BYTE left = 0;
                         if (byte >= BytesPerPixel) {
                             left = pDestData[byte - BytesPerPixel];
                         }
                         pDestData[byte] = raw_byte + left;
                         break;
@@ skipping 35 matching lines @@
                         break;
                     }
                 default:
                     pDestData[byte] = raw_byte;
                     break;
             }
             byte_cnt++;
         }
         pSrcData += row_size + 1;
         pDestData += row_size;
-        byte_cnt++;
     }
     FX_Free(data_buf);
     data_buf = dest_buf;
     data_size = row_size * row_count - (last_row_size > 0 ? (row_size + 1 - last_row_size) : 0);
 }
 static void TIFF_PredictorEncodeLine(FX_LPBYTE dest_buf, int row_size, int BitsPerComponent, int Colors, int Columns)
 {
     int BytesPerPixel = BitsPerComponent * Colors / 8;
     if (BitsPerComponent < 8) {
         FX_BYTE mask = 0x01;
@@ skipping 457 matching lines @@
     dest_size = src_size + src_size / 1000 + 12;
     dest_buf = FX_Alloc( FX_BYTE, dest_size);
     if (dest_buf == NULL) {
         return FALSE;
     }
     unsigned long temp_size = dest_size;
     FPDFAPI_FlateCompress(dest_buf, &temp_size, src_buf, src_size);
     dest_size = (FX_DWORD)temp_size;
     return TRUE;
 }