Check m_nComponents when using JBIG2Decode

core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fxge/fx_ge.h"
 #include "../../../include/fxcodec/fx_codec.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fpdfapi/fpdf_render.h"
@@ skipping 299 matching lines @@
     m_Width = m_pDict->GetInteger(FX_BSTRC("Width"));
     m_Height = m_pDict->GetInteger(FX_BSTRC("Height"));
     if (m_Width <= 0 || m_Height <= 0 || m_Width > 0x01ffff || m_Height > 0x01ffff) {
         return 0;
     }
     m_GroupFamily = GroupFamily;
     m_bLoadMask = bLoadMask;
     if (!LoadColorInfo(m_pStream->GetObjNum() != 0 ? NULL : pFormResources, pPageResources)) {
         return 0;
     }
-
     if (m_bpc == 0 || m_nComponents == 0) {
         return 0;
     }
-
     FX_SAFE_DWORD src_pitch = m_bpc;
     src_pitch *= m_nComponents;
     src_pitch *= m_Width;
     src_pitch += 7;
     src_pitch /= 8;
     src_pitch *= m_Height;
     if (!src_pitch.IsValid()) {
         return 0;
     }
-
     m_pStreamAcc = FX_NEW CPDF_StreamAcc;
     m_pStreamAcc->LoadAllData(pStream, FALSE, src_pitch.ValueOrDie(), TRUE);
     if (m_pStreamAcc->GetSize() == 0 || m_pStreamAcc->GetData() == NULL) {
         return 0;
     }
     const CFX_ByteString& decoder = m_pStreamAcc->GetImageDecoder();
-    if (!decoder.IsEmpty() && decoder == FX_BSTRC("CCITTFaxDecode")) {
-        m_bpc = 1;
-    }
     int ret = CreateDecoder();
     if (ret != 1) {
         if (!ret) {
             return ret;
         }
         if (!ContinueToLoadMask()) {
             return 0;
         }
         if (m_bHasMask) {
             StratLoadMask();
@@ skipping 89 matching lines @@
             m_pColorSpace->EnableStdConversion(FALSE);
         }
         return ret1;
     } else if (m_Status == 2) {
         return ContinueLoadMaskDIB(pPause);
     }
     return 0;
 }
 FX_BOOL CPDF_DIBSource::LoadColorInfo(CPDF_Dictionary* pFormResources, CPDF_Dictionary* pPageResources)
 {
-    m_bpc_orig = m_pDict->GetInteger(FX_BSTRC("BitsPerComponent"));
-    ValidateBpc();
     if (m_pDict->GetInteger("ImageMask")) {
         m_bImageMask = TRUE;
     }
     if (m_bImageMask || !m_pDict->KeyExist(FX_BSTRC("ColorSpace"))) {
         if (!m_bImageMask) {
             CPDF_Object* pFilter = m_pDict->GetElementValue(FX_BSTRC("Filter"));
             if (pFilter) {
                 CFX_ByteString filter;
                 if (pFilter->GetType() == PDFOBJ_NAME) {
                     filter = pFilter->GetString();
@@ skipping 33 matching lines @@
     if (m_Family == PDFCS_ICCBASED && pCSObj->GetType() == PDFOBJ_NAME) {
         CFX_ByteString cs = pCSObj->GetString();
         if (cs == FX_BSTRC("DeviceGray")) {
             m_nComponents = 1;
         } else if (cs == FX_BSTRC("DeviceRGB")) {
             m_nComponents = 3;
         } else if (cs == FX_BSTRC("DeviceCMYK")) {
             m_nComponents = 4;
         }
     }
+    m_bpc_orig = m_pDict->GetInteger(FX_BSTRC("BitsPerComponent"));

[Tom Sepez, 2014/09/02 22:11:54]

Maybe this assignment goes as the first line of ValidateDictParams().

[Bo Xu, 2014/09/02 22:27:13]

Done.

+    ValidateDictParam();
     m_pCompData = FX_Alloc(DIB_COMP_DATA, m_nComponents);
     if (m_bpc == 0) {
         return TRUE;
     }
     int max_data = (1 << m_bpc) - 1;
     CPDF_Array* pDecode = m_pDict->GetArray(FX_BSTRC("Decode"));
     if (pDecode) {
         for (FX_DWORD i = 0; i < m_nComponents; i ++) {
             m_pCompData[i].m_DecodeMin = pDecode->GetNumber(i * 2);
             FX_FLOAT max = pDecode->GetNumber(i * 2 + 1);
@@ skipping 390 matching lines @@
                 }
                 m_pColorSpace->GetRGB(temp_buf, R, G, B);
                 FX_Free(temp_buf);
             } else {
                 m_pColorSpace->GetRGB(color_value, R, G, B);
             }
             SetPaletteArgb(i, ArgbEncode(255, FXSYS_round(R * 255), FXSYS_round(G * 255), FXSYS_round(B * 255)));
         }
     }
 }
-void CPDF_DIBSource::ValidateBpc()
+void CPDF_DIBSource::ValidateDictParam()
 {
     m_bpc = m_bpc_orig;
         CPDF_Object * pFilter = m_pDict ? m_pDict->GetElementValue(FX_BSTRC("Filter")) : NULL;

[Tom Sepez, 2014/09/02 22:11:54]

nit: we de-ref'd m_pDict just before calling this method, hence it cant be NULL.

[Bo Xu, 2014/09/02 22:27:13]

Now check m_pDict in CPDF_DIBSource::Load to make sure m_pDict is not NULL here
and in LoadColorInfo()

     if (pFilter) {
         if (pFilter->GetType() == PDFOBJ_NAME) {
             CFX_ByteString filter = pFilter->GetString();
             if (filter == FX_BSTRC("CCITTFaxDecode") || filter == FX_BSTRC("JBIG2Decode")) {
                 m_bpc = 1;
+                m_nComponents = 1;
             }
             if (filter == FX_BSTRC("RunLengthDecode") || filter == FX_BSTRC("DCTDecode")) {
                 m_bpc = 8;
             }
         } else if (pFilter->GetType() == PDFOBJ_ARRAY) {
             CPDF_Array *pArray = (CPDF_Array *)pFilter;
             if (pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("CCITTFacDecode") ||
                     pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("JBIG2Decode")) {
                 m_bpc = 1;
+                m_nComponents = 1;
             }
             if (pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("RunLengthDecode") ||
                     pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("DCTDecode")) {
                 m_bpc = 8;
             }
         }
     }
     if (m_bpc != 1 && m_bpc != 2 && m_bpc != 4 && m_bpc != 8 && m_bpc != 16) {
         m_bpc = 0;
     }
@@ skipping 606 matching lines @@
     if (!m_bCached) {
         if (m_pBitmap) {
             delete m_pBitmap;
             m_pBitmap = NULL;
         }
         if (m_pMask) {
             delete m_pMask;
         }
     }
 }