Avoid OOB memcpy in chrome_pdf::CopyImage.

pdf/draw_utils.cc

Index: pdf/draw_utils.cc
diff --git a/pdf/draw_utils.cc b/pdf/draw_utils.cc
index 8bc3ac3ae1e6b12c9ceac5a0079980f7d363aef3..cd4ab607956b9aa1e633d52ca13bcc52197b804f 100644
--- a/pdf/draw_utils.cc
+++ b/pdf/draw_utils.cc
@@ -145,9 +145,12 @@ void GradientFill(pp::Instance* instance,
 void CopyImage(const pp::ImageData& src, const pp::Rect& src_rc,
                pp::ImageData* dest, const pp::Rect& dest_rc,
                bool stretch) {
-  DCHECK(src_rc.width() <= dest_rc.width() &&
-         src_rc.height() <= dest_rc.height());
-  if (src_rc.IsEmpty())
+  if (src_rc.IsEmpty() || !src.Contains(src_rc))
+    return;
+
+  pp::Rect stretched_rc(dest_rc.point(),
+                        stretch ? dest_rc.size() : src_rc.size());
+  if (stretched_rc.IsEmpty() || !dest->Contains(stretched_rc))
     return;
 
   const uint32_t* src_origin_pixel = src.GetAddr32(src_rc.point());