Allocate m_pCompData when |m_nComponents| is updated.

core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fxge/fx_ge.h"
 #include "../../../include/fxcodec/fx_codec.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fpdfapi/fpdf_render.h"
@@ skipping 478 matching lines @@
         CFX_ByteString cs = pCSObj->GetString();
         if (cs == FX_BSTRC("DeviceGray")) {
             m_nComponents = 1;
         } else if (cs == FX_BSTRC("DeviceRGB")) {
             m_nComponents = 3;
         } else if (cs == FX_BSTRC("DeviceCMYK")) {
             m_nComponents = 4;
         }
     }
     ValidateDictParam();
-    m_pCompData = FX_Alloc(DIB_COMP_DATA, m_nComponents);
-    if (m_bpc == 0) {
-        return TRUE;
+    m_pCompData = GetDecodeAndMaskArray(m_bDefaultDecode, m_bColorKey);

[jun_fang, 2014/09/03 19:12:02]

check |m_pCompData == NULL|?

[Bo Xu, 2014/09/03 19:36:59]

Done.

+    return TRUE;
+}
+DIB_COMP_DATA* CPDF_DIBSource::GetDecodeAndMaskArray(FX_BOOL& DefaultDecode, FX_BOOL& ColorKey)

[jun_fang, 2014/09/03 19:12:02]

rename DefaultDecode to bDefaultDecode and ColorKey to bColorKey?

[Bo Xu, 2014/09/03 19:36:59]

Done.

+{
+    DIB_COMP_DATA* pCompData = FX_Alloc(DIB_COMP_DATA, m_nComponents);
+    if (pCompData == NULL) {
+        return NULL;
     }
     int max_data = (1 << m_bpc) - 1;
     CPDF_Array* pDecode = m_pDict->GetArray(FX_BSTRC("Decode"));
     if (pDecode) {
         for (FX_DWORD i = 0; i < m_nComponents; i ++) {
-            m_pCompData[i].m_DecodeMin = pDecode->GetNumber(i * 2);
+            pCompData[i].m_DecodeMin = pDecode->GetNumber(i * 2);
             FX_FLOAT max = pDecode->GetNumber(i * 2 + 1);
-            m_pCompData[i].m_DecodeStep = (max - m_pCompData[i].m_DecodeMin) / max_data;
+            pCompData[i].m_DecodeStep = (max - pCompData[i].m_DecodeMin) / max_data;
             FX_FLOAT def_value, def_min, def_max;
             m_pColorSpace->GetDefaultValue(i, def_value, def_min, def_max);
             if (m_Family == PDFCS_INDEXED) {
                 def_max = (FX_FLOAT)max_data;
             }
-            if (def_min != m_pCompData[i].m_DecodeMin || def_max != max) {
-                m_bDefaultDecode = FALSE;
+            if (def_min != pCompData[i].m_DecodeMin || def_max != max) {
+                DefaultDecode = FALSE;
             }
         }
     } else {
         for (FX_DWORD i = 0; i < m_nComponents; i ++) {
             FX_FLOAT def_value;
-            m_pColorSpace->GetDefaultValue(i, def_value, m_pCompData[i].m_DecodeMin, m_pCompData[i].m_DecodeStep);
+            m_pColorSpace->GetDefaultValue(i, def_value, pCompData[i].m_DecodeMin, pCompData[i].m_DecodeStep);
             if (m_Family == PDFCS_INDEXED) {
-                m_pCompData[i].m_DecodeStep = (FX_FLOAT)max_data;
+                pCompData[i].m_DecodeStep = (FX_FLOAT)max_data;
             }
-            m_pCompData[i].m_DecodeStep = (m_pCompData[i].m_DecodeStep - m_pCompData[i].m_DecodeMin) / max_data;
+            pCompData[i].m_DecodeStep = (pCompData[i].m_DecodeStep - pCompData[i].m_DecodeMin) / max_data;
         }
     }
     if (!m_pDict->KeyExist(FX_BSTRC("SMask"))) {
         CPDF_Object* pMask = m_pDict->GetElementValue(FX_BSTRC("Mask"));
         if (pMask == NULL) {
-            return TRUE;
+            return pCompData;
         }
         if (pMask->GetType() == PDFOBJ_ARRAY) {
             CPDF_Array* pArray = (CPDF_Array*)pMask;
-            if (pArray->GetCount() >= m_nComponents * 2)
-                for (FX_DWORD i = 0; i < m_nComponents * 2; i ++) {
-                    if (i % 2) {
-                        m_pCompData[i / 2].m_ColorKeyMax = pArray->GetInteger(i);
-                    } else {
-                        m_pCompData[i / 2].m_ColorKeyMin = pArray->GetInteger(i);
-                    }
+            if (pArray->GetCount() >= m_nComponents * 2) {
+                for (FX_DWORD i = 0; i < m_nComponents; i++) {
+                    int min_num = pArray->GetInteger(i * 2);
+                    int max_num = pArray->GetInteger(i * 2 + 1);
+                    pCompData[i].m_ColorKeyMin = FX_MAX(min_num, 0);
+                    pCompData[i].m_ColorKeyMax = FX_MIN(max_num, max_data);
                 }
-            m_bColorKey = TRUE;
+            }
+            ColorKey = TRUE;
         }
     }
-    return TRUE;
+    return pCompData;
 }
 ICodec_ScanlineDecoder* FPDFAPI_CreateFaxDecoder(FX_LPCBYTE src_buf, FX_DWORD src_size, int width, int height,
         const CPDF_Dictionary* pParams);
 ICodec_ScanlineDecoder* FPDFAPI_CreateFlateDecoder(FX_LPCBYTE src_buf, FX_DWORD src_size, int width, int height,
         int nComps, int bpc, const CPDF_Dictionary* pParams);
 int CPDF_DIBSource::CreateDecoder()
 {
     const CFX_ByteString& decoder = m_pStreamAcc->GetImageDecoder();
     if (decoder.IsEmpty()) {
         return 1;
     }
     if (m_bpc == 0) {
         return 0;
     }
     FX_LPCBYTE src_data = m_pStreamAcc->GetData();
     FX_DWORD src_size = m_pStreamAcc->GetSize();
     const CPDF_Dictionary* pParams = m_pStreamAcc->GetImageParam();
     if (decoder == FX_BSTRC("CCITTFaxDecode")) {
         m_pDecoder = FPDFAPI_CreateFaxDecoder(src_data, src_size, m_Width, m_Height, pParams);
     } else if (decoder == FX_BSTRC("DCTDecode")) {
         m_pDecoder = CPDF_ModuleMgr::Get()->GetJpegModule()->CreateDecoder(src_data, src_size, m_Width, m_Height,
                      m_nComponents, pParams ? pParams->GetInteger(FX_BSTR("ColorTransform"), 1) : 1);
         if (NULL == m_pDecoder) {
             FX_BOOL bTransform = FALSE;
             int comps, bpc;
             ICodec_JpegModule* pJpegModule = CPDF_ModuleMgr::Get()->GetJpegModule();
             if (pJpegModule->LoadInfo(src_data, src_size, m_Width, m_Height, comps, bpc, bTransform)) {
-                m_nComponents = comps;
+                if (m_nComponents != comps) {
+                    m_nComponents = comps;
+                    FX_Free(m_pCompData);

[Tom Sepez, 2014/09/03 19:22:51]

nit:  I'd do the free before the assign to m_nComponents, just because ... um
... lets say the free() crashes, and yer digging through a stack trace, and it
might be nice to know the old value ... 

[Bo Xu, 2014/09/03 19:36:59]

Done.

+                    m_pCompData = GetDecodeAndMaskArray(m_bDefaultDecode, m_bColorKey);

[jun_fang, 2014/09/03 19:12:02]

Check |m_pCompData == NULL|?

[Bo Xu, 2014/09/03 19:36:59]

Done.

+                }
                 m_bpc = bpc;
                 m_pDecoder = CPDF_ModuleMgr::Get()->GetJpegModule()->CreateDecoder(src_data, src_size, m_Width, m_Height,
                              m_nComponents, bTransform);
             }
         }
     } else if (decoder == FX_BSTRC("FlateDecode")) {
         m_pDecoder = FPDFAPI_CreateFlateDecoder(src_data, src_size, m_Width, m_Height, m_nComponents, m_bpc, pParams);
     } else if (decoder == FX_BSTRC("JPXDecode")) {
         LoadJpxBitmap();
         return m_pCachedBitmap != NULL ? 1 : 0;
@@ skipping 566 matching lines @@
             }
             return m_pMaskedLine;
         }
         return m_pLineBuf;
     }
     if (m_bColorKey) {
         if (m_nComponents == 3 && m_bpc == 8) {
             FX_LPBYTE alpha_channel = m_pMaskedLine + 3;
             for (int col = 0; col < m_Width; col ++) {
                 FX_LPCBYTE pPixel = pSrcLine + col * 3;
-                alpha_channel[col * 4] = (pPixel[0] < m_pCompData[0].m_ColorKeyMin ||
-                                          pPixel[0] > m_pCompData[0].m_ColorKeyMax ||
+                alpha_channel[col * 4] = (pPixel[0] < m_pCompData[0].m_ColorKeyMin || pPixel[0] > m_pCompData[0].m_ColorKeyMax ||
                                           pPixel[1] < m_pCompData[1].m_ColorKeyMin || pPixel[1] > m_pCompData[1].m_ColorKeyMax ||
                                           pPixel[2] < m_pCompData[2].m_ColorKeyMin || pPixel[2] > m_pCompData[2].m_ColorKeyMax) ? 0xff : 0;
             }
         } else {
             FXSYS_memset8(m_pMaskedLine, 0xff, m_Pitch);
         }
     }
     if (m_pColorSpace) {
         TranslateScanline24bpp(m_pLineBuf, pSrcLine);
         pSrcLine = m_pLineBuf;
@@ skipping 371 matching lines @@
     if (!m_bCached) {
         if (m_pBitmap) {
             delete m_pBitmap;
             m_pBitmap = NULL;
         }
         if (m_pMask) {
             delete m_pMask;
         }
     }
 }