Preven OOB memory access in chrome_pdf::AlphaBlend().

pdf/draw_utils.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "pdf/draw_utils.h"
 
 #include <algorithm>
 #include <math.h>
 #include <vector>
 
@@ skipping 39 matching lines @@
       static_cast<uint32>(dest_color) * (0xFF - alpha);
   return static_cast<uint8>((processed / 0xFF) & 0xFF);
 }
 
 inline bool ImageDataContainsRect(const pp::ImageData& image_data,
                                   const pp::Rect& rect) {
   return rect.width() >= 0 && rect.height() >= 0 &&
       pp::Rect(image_data.size()).Contains(rect);
 }
 
-bool AlphaBlend(const pp::ImageData& src, const pp::Rect& src_rc,
+void AlphaBlend(const pp::ImageData& src, const pp::Rect& src_rc,
                 pp::ImageData* dest, const pp::Point& dest_origin,
                 uint8 alpha_adjustment) {
+  if (src_rc.IsEmpty() || !ImageDataContainsRect(src, src_rc))
+    return;
+
+  pp::Rect dest_rc(dest_origin, src_rc.size());
+  if (dest_rc.IsEmpty() || !ImageDataContainsRect(*dest, dest_rc))
+    return;
+
   const uint32_t* src_origin_pixel = src.GetAddr32(src_rc.point());
   uint32_t* dest_origin_pixel = dest->GetAddr32(dest_origin);
 
   int height = src_rc.height();
   int width = src_rc.width();
   for (int y = 0; y < height; y++) {
     const uint32_t* src_pixel = src_origin_pixel;
     uint32_t* dest_pixel = dest_origin_pixel;
     for (int x = 0; x < width; x++) {
       uint8 alpha = static_cast<uint8>(static_cast<uint32_t>(alpha_adjustment) *
           GetAlpha(*src_pixel) / 0xFF);
       uint8 red = ProcessColor(GetRed(*src_pixel), GetRed(*dest_pixel), alpha);
       uint8 green = ProcessColor(GetGreen(*src_pixel),
                                  GetGreen(*dest_pixel), alpha);
       uint8 blue = ProcessColor(GetBlue(*src_pixel),
                                 GetBlue(*dest_pixel), alpha);
       *dest_pixel = MakePixel(red, green, blue, GetAlpha(*dest_pixel));
 
       src_pixel++;
       dest_pixel++;
     }
     src_origin_pixel = reinterpret_cast<const uint32_t*>(
         reinterpret_cast<const char*>(src_origin_pixel) + src.stride());
     dest_origin_pixel = reinterpret_cast<uint32_t*>(
         reinterpret_cast<char*>(dest_origin_pixel) + dest->stride());
   }
-  return true;
 }
 
 void GradientFill(pp::ImageData* image, const pp::Rect& rc,
                   uint32 start_color, uint32 end_color, bool horizontal) {
   std::vector<uint32> colors;
   colors.resize(horizontal ? rc.width() : rc.height());
   for (size_t i = 0; i < colors.size(); ++i) {
     double ratio = static_cast<double>(i) / colors.size();
     colors[i] = MakePixel(
         GradientChannel(GetRed(start_color), GetRed(end_color), ratio),
@@ skipping 228 matching lines @@
   PaintShadow(image, rc.Intersect(clip_rc), shadow_rc, matrix);
 
   // Fill right part.
   rc = pp::Rect(object_rc.right(), object_rc.y(),
                 shadow_rc.right() - object_rc.right(), object_rc.height());
   PaintShadow(image, rc.Intersect(clip_rc), shadow_rc, matrix);
 }
 
 }  // namespace chrome_pdf