Fix JPX image rendering that regressed due to several security fixes.

core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
  
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "../../../include/fxge/fx_ge.h"
 #include "../../../include/fxcodec/fx_codec.h"
 #include "../../../include/fpdfapi/fpdf_module.h"
 #include "../../../include/fpdfapi/fpdf_render.h"
@@ skipping 101 matching lines @@
 CPDF_DIBSource::CPDF_DIBSource()
 {
     m_pDocument = NULL;
     m_pStreamAcc = NULL;
     m_pDict = NULL;
     m_bpp = 0;
     m_Width = m_Height = 0;
     m_pColorSpace = NULL;
     m_bDefaultDecode = TRUE;
     m_bImageMask = FALSE;
+    m_bDoBpcCheck = TRUE;
     m_pPalette = NULL;
     m_pCompData = NULL;
     m_bColorKey = FALSE;
     m_pMaskedLine = m_pLineBuf = NULL;
     m_pCachedBitmap = NULL;
     m_pDecoder = NULL;
     m_nComponents = 0;
     m_bpc = 0;
     m_bLoadMask = FALSE;
     m_Family = 0;
@@ skipping 58 matching lines @@
     m_Width = m_pDict->GetInteger(FX_BSTRC("Width"));
     m_Height = m_pDict->GetInteger(FX_BSTRC("Height"));
     if (m_Width <= 0 || m_Height <= 0 || m_Width > 0x01ffff || m_Height > 0x01ffff) {
         return FALSE;
     }
     m_GroupFamily = GroupFamily;
     m_bLoadMask = bLoadMask;
     if (!LoadColorInfo(m_pStream->GetObjNum() != 0 ? NULL : pFormResources, pPageResources)) {
         return FALSE;
     }
-    if (m_bpc == 0 || m_nComponents == 0) {
+    if (m_bDoBpcCheck && (m_bpc == 0 || m_nComponents == 0)) {
         return FALSE;
     }
     FX_SAFE_DWORD src_pitch =
         CalculatePitch8(m_bpc, m_nComponents, m_Width, m_Height);
     if (!src_pitch.IsValid()) {
         return FALSE;
     }
     m_pStreamAcc = FX_NEW CPDF_StreamAcc;
     m_pStreamAcc->LoadAllData(pStream, FALSE, src_pitch.ValueOrDie(), TRUE);
     if (m_pStreamAcc->GetSize() == 0 || m_pStreamAcc->GetData() == NULL) {
         return FALSE;
     }
     const CFX_ByteString& decoder = m_pStreamAcc->GetImageDecoder();
-    if (!decoder.IsEmpty() && decoder == FX_BSTRC("CCITTFaxDecode")) {
+    if (decoder == FX_BSTRC("CCITTFaxDecode")) {
+        m_bDoBpcCheck = TRUE;
         m_bpc = 1;

[Lei Zhang, 2015/02/07 08:39:11]

I don't have a test image, but I don't see how this can work given the |m_bpc|
check on line 201. So I modified LoadColorInfo() to skip the check for
"CCITTFaxDecode" as well.

In patch set 1, I suspected we can skip the check for JPX, CCITTFax, and JBIG2.
I didn't make the change for JBIG2, but I still suspect we need to.

     }
     if (!CreateDecoder()) {
         return FALSE;
     }
     if (m_bImageMask) {
         m_bpp = 1;
         m_bpc = 1;
         m_nComponents = 1;
         m_AlphaFlag = 1;
     } else if (m_bpc * m_nComponents == 1) {
@@ skipping 83 matching lines @@
     m_Width = m_pDict->GetInteger(FX_BSTRC("Width"));
     m_Height = m_pDict->GetInteger(FX_BSTRC("Height"));
     if (m_Width <= 0 || m_Height <= 0 || m_Width > 0x01ffff || m_Height > 0x01ffff) {
         return 0;
     }
     m_GroupFamily = GroupFamily;
     m_bLoadMask = bLoadMask;
     if (!LoadColorInfo(m_pStream->GetObjNum() != 0 ? NULL : pFormResources, pPageResources)) {
         return 0;
     }
-    if (m_bpc == 0 || m_nComponents == 0) {
+    if (m_bDoBpcCheck && (m_bpc == 0 || m_nComponents == 0)) {
         return 0;
     }
     FX_SAFE_DWORD src_pitch =
         CalculatePitch8(m_bpc, m_nComponents, m_Width, m_Height);
     if (!src_pitch.IsValid()) {
         return 0;
     }
     m_pStreamAcc = FX_NEW CPDF_StreamAcc;
     m_pStreamAcc->LoadAllData(pStream, FALSE, src_pitch.ValueOrDie(), TRUE);
     if (m_pStreamAcc->GetSize() == 0 || m_pStreamAcc->GetData() == NULL) {
         return 0;
     }
+    const CFX_ByteString& decoder = m_pStreamAcc->GetImageDecoder();
+    if (decoder == FX_BSTRC("CCITTFaxDecode")) {
+        m_bDoBpcCheck = TRUE;
+        m_bpc = 1;
+    }
     int ret = CreateDecoder();
     if (ret != 1) {
         if (!ret) {
             return ret;
         }
         if (!ContinueToLoadMask()) {
             return 0;
         }
         if (m_bHasMask) {
             StratLoadMask();
@@ skipping 96 matching lines @@
     if (m_pDict->GetInteger("ImageMask")) {
         m_bImageMask = TRUE;
     }
     if (m_bImageMask || !m_pDict->KeyExist(FX_BSTRC("ColorSpace"))) {
         if (!m_bImageMask) {
             CPDF_Object* pFilter = m_pDict->GetElementValue(FX_BSTRC("Filter"));
             if (pFilter) {
                 CFX_ByteString filter;
                 if (pFilter->GetType() == PDFOBJ_NAME) {
                     filter = pFilter->GetString();
-                    if (filter == FX_BSTRC("JPXDecode")) {
+                    if (filter == FX_BSTRC("JPXDecode") ||
+                        filter == FX_BSTRC("CCITTFaxDecode")) {
+                        m_bDoBpcCheck = FALSE;
                         return TRUE;
                     }
                 } else if (pFilter->GetType() == PDFOBJ_ARRAY) {
                     CPDF_Array* pArray = (CPDF_Array*)pFilter;
-                    if (pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("JPXDecode")) {
+                    if (pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("JPXDecode") ||
+                        pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("CCITTFaxDecode")) {
+                        m_bDoBpcCheck = FALSE;
                         return TRUE;
                     }
                 }
             }
         }
         m_bImageMask = TRUE;
         m_bpc = m_nComponents = 1;
         CPDF_Array* pDecode = m_pDict->GetArray(FX_BSTRC("Decode"));
         m_bDefaultDecode = pDecode == NULL || pDecode->GetInteger(0) == 0;
         return TRUE;
@@ skipping 89 matching lines @@
 ICodec_ScanlineDecoder* FPDFAPI_CreateFaxDecoder(FX_LPCBYTE src_buf, FX_DWORD src_size, int width, int height,
         const CPDF_Dictionary* pParams);
 ICodec_ScanlineDecoder* FPDFAPI_CreateFlateDecoder(FX_LPCBYTE src_buf, FX_DWORD src_size, int width, int height,
         int nComps, int bpc, const CPDF_Dictionary* pParams);
 int CPDF_DIBSource::CreateDecoder()
 {
     const CFX_ByteString& decoder = m_pStreamAcc->GetImageDecoder();
     if (decoder.IsEmpty()) {
         return 1;
     }
-    if (m_bpc == 0) {
+    if (m_bDoBpcCheck && m_bpc == 0) {
         return 0;
     }
     FX_LPCBYTE src_data = m_pStreamAcc->GetData();
     FX_DWORD src_size = m_pStreamAcc->GetSize();
     const CPDF_Dictionary* pParams = m_pStreamAcc->GetImageParam();
     if (decoder == FX_BSTRC("CCITTFaxDecode")) {
         m_pDecoder = FPDFAPI_CreateFaxDecoder(src_data, src_size, m_Width, m_Height, pParams);
     } else if (decoder == FX_BSTRC("DCTDecode")) {
         m_pDecoder = CPDF_ModuleMgr::Get()->GetJpegModule()->CreateDecoder(src_data, src_size, m_Width, m_Height,
                      m_nComponents, pParams ? pParams->GetInteger(FX_BSTR("ColorTransform"), 1) : 1);
@@ skipping 308 matching lines @@
             } else {
                 m_pColorSpace->GetRGB(color_value, R, G, B);
             }
             SetPaletteArgb(i, ArgbEncode(255, FXSYS_round(R * 255), FXSYS_round(G * 255), FXSYS_round(B * 255)));
         }
     }
 }
 void CPDF_DIBSource::ValidateDictParam()
 {
     m_bpc = m_bpc_orig;
-        CPDF_Object * pFilter = m_pDict->GetElementValue(FX_BSTRC("Filter"));
+    CPDF_Object * pFilter = m_pDict->GetElementValue(FX_BSTRC("Filter"));
     if (pFilter) {
         if (pFilter->GetType() == PDFOBJ_NAME) {
             CFX_ByteString filter = pFilter->GetString();
             if (filter == FX_BSTRC("CCITTFaxDecode") || filter == FX_BSTRC("JBIG2Decode")) {
                 m_bpc = 1;
                 m_nComponents = 1;
             }
             if (filter == FX_BSTRC("RunLengthDecode") || filter == FX_BSTRC("DCTDecode")) {
                 m_bpc = 8;
             }
         } else if (pFilter->GetType() == PDFOBJ_ARRAY) {
             CPDF_Array *pArray = (CPDF_Array *)pFilter;
-            if (pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("CCITTFacDecode") ||
+            if (pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("CCITTFaxDecode") ||
                     pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("JBIG2Decode")) {
                 m_bpc = 1;
                 m_nComponents = 1;
             }
             if (pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("DCTDecode")) {
                 // Previously, pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("RunLengthDecode") was checked in the "if" statement as well,
                 // but too many documents don't conform to it.
                 m_bpc = 8;
             }
         }
@@ skipping 593 matching lines @@
 {
     return ((CPDF_ProgressiveImageLoaderHandle*)LoadHandle)->Continue(pPause);
 }
 CPDF_ImageLoader::~CPDF_ImageLoader()
 {
     if (!m_bCached) {
         delete m_pBitmap;
         delete m_pMask;
     }
 }