Allocate m_pCompData when |m_nComponents| is updated.

core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp

Index: core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp
diff --git a/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp b/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp
index 50041399e5639c1d1a759f7e56b38bebea22236b..51cc8ce1b25bd2d0b0aeb1eba43e6a13ec43e601 100644
--- a/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp
+++ b/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp
@@ -182,6 +182,7 @@ FX_BOOL CPDF_DIBSource::Load(CPDF_Document* pDoc, const CPDF_Stream* pStream, CP
     if (m_bpc == 0 || m_nComponents == 0) {
         return FALSE;
     }
+    AllocCompData();

[jun_fang, 2014/09/03 04:17:08]

m_pCompData = GetCompData();
if (!m_pCompData) {
    return;
}

It's better to get component data in a distinct way than changing the variable
m_pCompData inside the function.I suggest to rename AllocCompData because this
function do more jobs than only allocating memory.

     FX_SAFE_DWORD src_pitch = m_bpc;
     src_pitch *= m_nComponents;
     src_pitch *= m_Width;
@@ -317,6 +318,7 @@ int	CPDF_DIBSource::StartLoadDIBSource(CPDF_Document* pDoc, const CPDF_Stream* p
     if (m_bpc == 0 || m_nComponents == 0) {
         return 0;
     }
+    AllocCompData();
     FX_SAFE_DWORD src_pitch = m_bpc;
     src_pitch *= m_nComponents;
     src_pitch *= m_Width;
@@ -496,10 +498,11 @@ FX_BOOL CPDF_DIBSource::LoadColorInfo(CPDF_Dictionary* pFormResources, CPDF_Dict
         }
     }
     ValidateDictParam();
+    return TRUE;
+}
+void CPDF_DIBSource::AllocCompData()
+{
     m_pCompData = FX_Alloc(DIB_COMP_DATA, m_nComponents);
-    if (m_bpc == 0) {
-        return TRUE;
-    }
     int max_data = (1 << m_bpc) - 1;
     CPDF_Array* pDecode = m_pDict->GetArray(FX_BSTRC("Decode"));
     if (pDecode) {
@@ -529,22 +532,22 @@ FX_BOOL CPDF_DIBSource::LoadColorInfo(CPDF_Dictionary* pFormResources, CPDF_Dict
     if (!m_pDict->KeyExist(FX_BSTRC("SMask"))) {
         CPDF_Object* pMask = m_pDict->GetElementValue(FX_BSTRC("Mask"));
         if (pMask == NULL) {
-            return TRUE;
+            return;
         }
         if (pMask->GetType() == PDFOBJ_ARRAY) {
             CPDF_Array* pArray = (CPDF_Array*)pMask;
-            if (pArray->GetCount() >= m_nComponents * 2)
-                for (FX_DWORD i = 0; i < m_nComponents * 2; i ++) {
-                    if (i % 2) {
-                        m_pCompData[i / 2].m_ColorKeyMax = pArray->GetInteger(i);
-                    } else {
-                        m_pCompData[i / 2].m_ColorKeyMin = pArray->GetInteger(i);
-                    }
+            if (pArray->GetCount() >= m_nComponents * 2) {
+                int min_num, max_num;
+                for (FX_DWORD i = 0; i < m_nComponents; i++) {
+                    min_num = pArray->GetInteger(i * 2);
+                    max_num = pArray->GetInteger(i * 2 + 1);
+                    m_pCompData[i].m_ColorKeyMin = FX_MAX(0, min_num);
+                    m_pCompData[i].m_ColorKeyMax = FX_MIN((1 << m_bpc) - 1, max_num);
                 }
+            }
             m_bColorKey = TRUE;
         }
     }
-    return TRUE;
 }
 ICodec_ScanlineDecoder* FPDFAPI_CreateFaxDecoder(FX_LPCBYTE src_buf, FX_DWORD src_size, int width, int height,
         const CPDF_Dictionary* pParams);
@@ -572,7 +575,11 @@ int CPDF_DIBSource::CreateDecoder()
             int comps, bpc;
             ICodec_JpegModule* pJpegModule = CPDF_ModuleMgr::Get()->GetJpegModule();
             if (pJpegModule->LoadInfo(src_data, src_size, m_Width, m_Height, comps, bpc, bTransform)) {
-                m_nComponents = comps;
+                if (m_nComponents != comps) {
+                    m_nComponents = comps;
+                    FX_Free(m_pCompData);
+                    AllocCompData();
+                }
                 m_bpc = bpc;
                 m_pDecoder = CPDF_ModuleMgr::Get()->GetJpegModule()->CreateDecoder(src_data, src_size, m_Width, m_Height,
                              m_nComponents, bTransform);
@@ -1159,8 +1166,7 @@ FX_LPCBYTE CPDF_DIBSource::GetScanline(int line) const
             FX_LPBYTE alpha_channel = m_pMaskedLine + 3;
             for (int col = 0; col < m_Width; col ++) {
                 FX_LPCBYTE pPixel = pSrcLine + col * 3;
-                alpha_channel[col * 4] = (pPixel[0] < m_pCompData[0].m_ColorKeyMin ||
-                                          pPixel[0] > m_pCompData[0].m_ColorKeyMax ||
+                alpha_channel[col * 4] = (pPixel[0] < m_pCompData[0].m_ColorKeyMin || pPixel[0] > m_pCompData[0].m_ColorKeyMax ||
                                           pPixel[1] < m_pCompData[1].m_ColorKeyMin || pPixel[1] > m_pCompData[1].m_ColorKeyMax ||
                                           pPixel[2] < m_pCompData[2].m_ColorKeyMin || pPixel[2] > m_pCompData[2].m_ColorKeyMax) ? 0xff : 0;
             }