Use valid bpc value in LoadPalette() and ContinueToLoadMask()

core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fxge/fx_ge.h"
 #include "../../../include/fxcodec/fx_codec.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fpdfapi/fpdf_render.h"
@@ skipping 235 matching lines @@
     if (ppMask) {
         *ppMask = LoadMask(*pMatteColor);
     }
     if (m_pColorSpace && bStdCS) {
         m_pColorSpace->EnableStdConversion(FALSE);
     }
     return TRUE;
 }
 int     CPDF_DIBSource::ContinueToLoadMask()
 {
+    FX_DWORD bpc = GetValidBpc();
     if (m_bImageMask) {
         m_bpp = 1;
-        m_bpc = 1;
+        bpc = 1;
         m_nComponents = 1;
         m_AlphaFlag = 1;
-    } else if (m_bpc * m_nComponents == 1) {
+    } else if (bpc * m_nComponents == 1) {
         m_bpp = 1;
-    } else if (m_bpc * m_nComponents <= 8) {
+    } else if (bpc * m_nComponents <= 8) {
         m_bpp = 8;
     } else {
         m_bpp = 24;
     }
-    if (!m_bpc || !m_nComponents) {
+    if (!bpc || !m_nComponents) {
         return 0;
     }
     FX_SAFE_DWORD pitch = m_Width;
     pitch *= m_bpp;
     pitch += 31;
     pitch /= 8;
     if (!pitch.IsValid()) {
         return 0;
     }
     m_pLineBuf = FX_Alloc(FX_BYTE, pitch.ValueOrDie());
@@ skipping 568 matching lines @@
     }
     if (!ret) {
         delete m_pMask;
         m_pMask = NULL;
         return 1;
     }
     return 1;
 }
 void CPDF_DIBSource::LoadPalette()
 {
-    if (m_bpc * m_nComponents > 8) {
+    FX_DWORD bpc = GetValidBpc();

[Tom Sepez, 2014/08/27 20:26:49]

Do we want to return early if this is 0?

[Bo Xu, 2014/08/27 20:37:24]

Right! Done. There are a few other instances of not checking bpc==0, I will fix
them in a later cleanup patch too.

+    if (bpc * m_nComponents > 8) {
         return;
     }
     if (m_pColorSpace == NULL) {
         return;
     }
-    if (m_bpc * m_nComponents == 1) {
+    if (bpc * m_nComponents == 1) {
         if (m_bDefaultDecode && (m_Family == PDFCS_DEVICEGRAY || m_Family == PDFCS_DEVICERGB)) {
             return;
         }
         if (m_pColorSpace->CountComponents() > 3) {
             return;
         }
         FX_FLOAT color_values[3];
         color_values[0] = m_pCompData[0].m_DecodeMin;
         color_values[1] = color_values[2] = color_values[0];
         FX_FLOAT R=0.0f, G=0.0f, B=0.0f;
         m_pColorSpace->GetRGB(color_values, R, G, B);
         FX_ARGB argb0 = ArgbEncode(255, FXSYS_round(R * 255), FXSYS_round(G * 255), FXSYS_round(B * 255));
         color_values[0] += m_pCompData[0].m_DecodeStep;
         color_values[1] += m_pCompData[0].m_DecodeStep;
         color_values[2] += m_pCompData[0].m_DecodeStep;
         m_pColorSpace->GetRGB(color_values, R, G, B);
         FX_ARGB argb1 = ArgbEncode(255, FXSYS_round(R * 255), FXSYS_round(G * 255), FXSYS_round(B * 255));
         if (argb0 != 0xFF000000 || argb1 != 0xFFFFFFFF) {
             SetPaletteArgb(0, argb0);
             SetPaletteArgb(1, argb1);
         }
         return;
     }
-    if (m_pColorSpace == CPDF_ColorSpace::GetStockCS(PDFCS_DEVICEGRAY) && m_bpc == 8 && m_bDefaultDecode) {
+    if (m_pColorSpace == CPDF_ColorSpace::GetStockCS(PDFCS_DEVICEGRAY) && bpc == 8 && m_bDefaultDecode) {
     } else {
-        int palette_count = 1 << (m_bpc * m_nComponents);
+        int palette_count = 1 << (bpc * m_nComponents);
         CFX_FixedBufGrow<FX_FLOAT, 16> color_values(m_nComponents);
         FX_FLOAT* color_value = color_values;
         for (int i = 0; i < palette_count; i ++) {
             int color_data = i;
             for (FX_DWORD j = 0; j < m_nComponents; j ++) {
-                int encoded_component = color_data % (1 << m_bpc);
-                color_data /= 1 << m_bpc;
+                int encoded_component = color_data % (1 << bpc);
+                color_data /= 1 << bpc;
                 color_value[j] = m_pCompData[j].m_DecodeMin + m_pCompData[j].m_DecodeStep * encoded_component;
             }
             FX_FLOAT R = 0, G = 0, B = 0;
             if (m_nComponents == 1 && m_Family == PDFCS_ICCBASED && m_pColorSpace->CountComponents() > 1) {
                 int nComponents = m_pColorSpace->CountComponents();
                 FX_FLOAT* temp_buf = FX_Alloc(FX_FLOAT, nComponents);
                 for (int i = 0; i < nComponents; i++) {
                     temp_buf[i] = *color_value;
                 }
                 m_pColorSpace->GetRGB(temp_buf, R, G, B);
@@ skipping 23 matching lines @@
             if (pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("CCITTFacDecode") ||
                     pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("JBIG2Decode")) {
                 bpc = 1;
             }
             if (pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("RunLengthDecode") ||
                     pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("DCTDecode")) {
                 bpc = 8;
             }
         }
     }
-    if (bpc != 1 && bpc != 2 && bpc != 4 && bpc != 8 && bpc != 12 && bpc != 16) {
+    if (bpc != 1 && bpc != 2 && bpc != 4 && bpc != 8 && bpc != 16) {
         bpc = 0;
     }
 
     return bpc;
 }
 #define NORMALCOLOR_MAX(color, max) (color) > (max) ? (max) : (color) < 0 ? 0 : (color);
 void CPDF_DIBSource::TranslateScanline24bpp(FX_LPBYTE dest_scan, FX_LPCBYTE src_scan) const
 {
     FX_DWORD bpc = GetValidBpc();
     if (bpc == 0) {
@@ skipping 604 matching lines @@
     if (!m_bCached) {
         if (m_pBitmap) {
             delete m_pBitmap;
             m_pBitmap = NULL;
         }
         if (m_pMask) {
             delete m_pMask;
         }
     }
 }