Avoid OOB memcpy in chrome_pdf::CopyImage.

pdf/draw_utils.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "pdf/draw_utils.h"
 
 #include <algorithm>
 #include <math.h>
 #include <vector>
 
@@ skipping 33 matching lines @@
     return 255;
   return static_cast<uint8>(new_channel + 0.5);
 }
 
 inline uint8 ProcessColor(uint8 src_color, uint8 dest_color, uint8 alpha) {
   uint32 processed = static_cast<uint32>(src_color) * alpha +
       static_cast<uint32>(dest_color) * (0xFF - alpha);
   return static_cast<uint8>((processed / 0xFF) & 0xFF);
 }
 
+inline bool ImageDataContainsRect(const pp::ImageData& image_data,
+                                  const pp::Rect& rect) {
+  return rect.width() >= 0 && rect.height() >= 0 &&
+      pp::Rect(image_data.size()).Contains(rect);
+}
+
 bool AlphaBlend(const pp::ImageData& src, const pp::Rect& src_rc,
                 pp::ImageData* dest, const pp::Point& dest_origin,
                 uint8 alpha_adjustment) {
   const uint32_t* src_origin_pixel = src.GetAddr32(src_rc.point());
   uint32_t* dest_origin_pixel = dest->GetAddr32(dest_origin);
 
   int height = src_rc.height();
   int width = src_rc.width();
   for (int y = 0; y < height; y++) {
     const uint32_t* src_pixel = src_origin_pixel;
@@ skipping 74 matching lines @@
                start_color, end_color, horizontal);
 
   pp::Rect copy_rc(draw_rc);
   copy_rc.Offset(-gradient_rc.x(), -gradient_rc.y());
   AlphaBlend(gradient, copy_rc, image, draw_rc.point(), transparency);
 }
 
 void CopyImage(const pp::ImageData& src, const pp::Rect& src_rc,
                pp::ImageData* dest, const pp::Rect& dest_rc,
                bool stretch) {
-  DCHECK(src_rc.width() <= dest_rc.width() &&
-         src_rc.height() <= dest_rc.height());
-  if (src_rc.IsEmpty())
+  if (src_rc.IsEmpty() || !ImageDataContainsRect(src, src_rc))
+    return;
+
+  pp::Rect stretched_rc(dest_rc.point(),
+                        stretch ? dest_rc.size() : src_rc.size());
+  if (stretched_rc.IsEmpty() || !ImageDataContainsRect(*dest, stretched_rc))
     return;
 
   const uint32_t* src_origin_pixel = src.GetAddr32(src_rc.point());
   uint32_t* dest_origin_pixel = dest->GetAddr32(dest_rc.point());
   if (stretch) {
     double x_ratio = static_cast<double>(src_rc.width()) / dest_rc.width();
     double y_ratio = static_cast<double>(src_rc.height()) / dest_rc.height();
     int32_t height = dest_rc.height();
     int32_t width = dest_rc.width();
     for (int32_t y = 0; y < height; ++y) {
@@ skipping 158 matching lines @@
   PaintShadow(image, rc.Intersect(clip_rc), shadow_rc, matrix);
 
   // Fill right part.
   rc = pp::Rect(object_rc.right(), object_rc.y(),
                 shadow_rc.right() - object_rc.right(), object_rc.height());
   PaintShadow(image, rc.Intersect(clip_rc), shadow_rc, matrix);
 }
 
 }  // namespace chrome_pdf