Restrict index not be greater than row_size in TIFF_PredictLine

core/src/fxcodec/codec/fx_codec_flate.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../fx_zlib.h"
 #include "../../../include/fxcodec/fx_codec.h"
 #include "codec_int.h"
 extern "C"
@@ skipping 506 matching lines @@
         FX_LPBYTE scan_line = data_buf + row * row_size;
         if ((row + 1) * row_size > (int)data_size) {
             row_size = last_row_size;
         }
         TIFF_PredictorEncodeLine(scan_line, row_size, BitsPerComponent, Colors, Columns);
     }
 }
 static void TIFF_PredictLine(FX_LPBYTE dest_buf, int row_size, int BitsPerComponent, int Colors, int Columns)
 {
     if (BitsPerComponent == 1) {
         int row_bits = BitsPerComponent * Colors * Columns;

[Tom Sepez, 2014/08/27 21:25:45]

nit: the multiply by 1 seems unnecessary.

[Bo Xu, 2014/08/27 22:13:18]

Maybe we should keep it here to make the meaning more straightforward? As
|BitsPerComponent * Colors * Columns| is usually a binding group in elsewhere.

         for(int i = 1; i < row_bits; i ++) {
             int col = i % 8;
             int index = i / 8;
+            if (index > row_size) {

[Tom Sepez, 2014/08/27 21:20:35]

Don't you want >= ? 

[Tom Sepez, 2014/08/27 21:25:45]

Maybe we prune row_bits outside the loop to avoid having to test each time.

[Bo Xu, 2014/08/27 22:13:18]

Good idea.

+                break;
+            }
             int index_pre = (col == 0) ? (index - 1) : index;

[Tom Sepez, 2014/08/27 21:25:45]

nit:  maybe these should move outsize the loop, start at (0, 0) and get assigned
to the current col, row at the bottom of the loop?

[Bo Xu, 2014/08/27 22:13:18]

Done.

             int col_pre = (col == 0) ? 8 : col;

[Tom Sepez, 2014/08/27 21:35:33]

8 seems like a weird value to assign to a variable thats normally the resuult of
i % 8 and should be in the 0..7

             if( ((dest_buf[index] >> (7 - col)) & 1) ^ ((dest_buf[index_pre] >> (8 - col_pre)) & 1) ) {

[Tom Sepez, 2014/08/27 21:35:33]

This would need to change if you followed the above comment.

                 dest_buf[index] |= 1 << (7 - col);
             } else {
                 dest_buf[index] &= ~(1 << (7 - col));
             }
         }
         return;
     }
     int BytesPerPixel = BitsPerComponent * Colors / 8;
     if (BitsPerComponent == 16) {
         for (int i = BytesPerPixel; i < row_size; i += 2) {
@@ skipping 391 matching lines @@
     dest_size = src_size + src_size / 1000 + 12;
     dest_buf = FX_Alloc( FX_BYTE, dest_size);
     if (dest_buf == NULL) {
         return FALSE;
     }
     unsigned long temp_size = dest_size;
     FPDFAPI_FlateCompress(dest_buf, &temp_size, src_buf, src_size);
     dest_size = (FX_DWORD)temp_size;
     return TRUE;
 }