Fix buffer size offset error in PNG_Predictor

core/src/fxcodec/codec/fx_codec_flate.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../fx_zlib.h"
 #include "../../../include/fxcodec/fx_codec.h"
 #include "codec_int.h"
 extern "C"
@@ skipping 380 matching lines @@
     int last_row_size = data_size % (row_size + 1);
     FX_LPBYTE dest_buf = FX_Alloc( FX_BYTE, row_size * row_count);
     if (dest_buf == NULL) {
         return;
     }
     int byte_cnt = 0;
     FX_LPBYTE pSrcData = data_buf;
     FX_LPBYTE pDestData = dest_buf;
     for (int row = 0; row < row_count; row ++) {
         FX_BYTE tag = pSrcData[0];
+        byte_cnt++;
         if (tag == 0) {
             int move_size = row_size;
             if ((row + 1) * (move_size + 1) > (int)data_size) {
                 move_size = last_row_size - 1;
             }
             FXSYS_memmove32(pDestData, pSrcData + 1, move_size);
             pSrcData += move_size + 1;
             pDestData += move_size;
-            byte_cnt += move_size + 1;
+            byte_cnt += move_size;
             continue;
         }
         for (int byte = 0; byte < row_size && byte_cnt < (int)data_size; byte ++) {
             FX_BYTE raw_byte = pSrcData[byte + 1];
             switch (tag) {
                 case 1: {
                         FX_BYTE left = 0;
                         if (byte >= BytesPerPixel) {
                             left = pDestData[byte - BytesPerPixel];
                         }
@@ skipping 37 matching lines @@
                         break;
                     }
                 default:
                     pDestData[byte] = raw_byte;
                     break;
             }
             byte_cnt++;
         }
         pSrcData += row_size + 1;
         pDestData += row_size;
-        byte_cnt++;
     }
     FX_Free(data_buf);
     data_buf = dest_buf;
     data_size = row_size * row_count - (last_row_size > 0 ? (row_size + 1 - last_row_size) : 0);
 }
 static void TIFF_PredictorEncodeLine(FX_LPBYTE dest_buf, int row_size, int BitsPerComponent, int Colors, int Columns)
 {
     int BytesPerPixel = BitsPerComponent * Colors / 8;
     if (BitsPerComponent < 8) {
         FX_BYTE mask = 0x01;
@@ skipping 457 matching lines @@
     dest_size = src_size + src_size / 1000 + 12;
     dest_buf = FX_Alloc( FX_BYTE, dest_size);
     if (dest_buf == NULL) {
         return FALSE;
     }
     unsigned long temp_size = dest_size;
     FPDFAPI_FlateCompress(dest_buf, &temp_size, src_buf, src_size);
     dest_size = (FX_DWORD)temp_size;
     return TRUE;
 }