Fix an error 'Use-of-uninitialized-value in CPDF_Function::Call'

core/src/fpdfapi/fpdf_page/fpdf_page_func.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include <limits.h>
 
 #include "../../../include/fpdfapi/fpdf_page.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
@@ skipping 549 matching lines @@
     FX_SAFE_INT32 bitpos = pos;
     bitpos *= m_nBitsPerSample;
     bitpos *= m_nOutputs;
     if (!bitpos.IsValid()) {
         return FALSE;
     }
     FX_LPCBYTE pSampleData = m_pSampleStream->GetData();
     if (pSampleData == NULL) {
         return FALSE;
     }
     FX_SAFE_INT32 bitpos1 = m_nOutputs - 1 > 0 ? m_nOutputs - 1 : 0; 

[Tom Sepez, 2015/02/12 18:06:46]

Looking at the original code, I don't remember why we subtracted 1 here.  Is
that a mistake?

[jun_fang, 2015/02/12 18:13:35]

This judge is used to ensure 'bitpos.ValueOrDie() + j * m_nBitsPerSample' at
line 577 not to overflow. The maxium of 'j' is  m_nOutputs - 1 . 

     bitpos1 *= m_nBitsPerSample;
     bitpos1 += bitpos.ValueOrDie();
     if (!bitpos1.IsValid()) {
         return FALSE;
     }
     for (int j = 0; j < m_nOutputs; j ++) {
         FX_DWORD sample = _GetBits32(pSampleData, bitpos.ValueOrDie() + j * m_nBitsPerSample, m_nBitsPerSample);
         FX_FLOAT encoded = (FX_FLOAT)sample;
         for (int i = 0; i < m_nInputs; i ++) {
             if (index[i] == m_pEncodeInfo[i].sizes - 1) {
                 if (index[i] == 0) {
                     encoded = encoded_input[i] * (FX_FLOAT)sample;
                 }
             } else {
                 FX_SAFE_INT32 bitpos2 = blocksize[i];
-                bitpos2 += 1;
+                bitpos2 += pos;
+                bitpos2 *= m_nOutputs;
+                bitpos2 += j;
                 bitpos2 *= m_nBitsPerSample; 
-                bitpos2 *= m_nOutputs;
-                bitpos2 += bitpos.ValueOrDie();
                 if (!bitpos2.IsValid()) {
                     return FALSE;
                 }
                 FX_DWORD sample1 = _GetBits32(pSampleData, bitpos2.ValueOrDie(), m_nBitsPerSample);
                 encoded += (encoded_input[i] - index[i]) * ((FX_FLOAT)sample1 - (FX_FLOAT)sample);
             }
         }
         results[j] = PDF_Interpolate(encoded, 0, (FX_FLOAT)m_SampleMax,
                                      m_pDecodeInfo[j].decode_min, m_pDecodeInfo[j].decode_max);
     }
@@ skipping 298 matching lines @@
         for (int i = 0; i < m_nOutputs; i ++) {
             if (results[i] < m_pRanges[i * 2]) {
                 results[i] = m_pRanges[i * 2];
             } else if (results[i] > m_pRanges[i * 2 + 1]) {
                 results[i] = m_pRanges[i * 2 + 1];
             }
         }
     }
     return TRUE;
 }