Fix JPX image rendering that regressed due to several security fixes.

core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp

Index: core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp
diff --git a/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp b/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp
index 4583bc1b25ef38b2f8119a433675695e1f174a56..d5cfe45af5bae125c19c949ef86bba3aab848cdd 100644
--- a/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp
+++ b/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp
@@ -119,6 +119,7 @@ CPDF_DIBSource::CPDF_DIBSource()
     m_pColorSpace = NULL;
     m_bDefaultDecode = TRUE;
     m_bImageMask = FALSE;
+    m_bDoBpcCheck = TRUE;
     m_pPalette = NULL;
     m_pCompData = NULL;
     m_bColorKey = FALSE;
@@ -197,7 +198,7 @@ FX_BOOL CPDF_DIBSource::Load(CPDF_Document* pDoc, const CPDF_Stream* pStream, CP
     if (!LoadColorInfo(m_pStream->GetObjNum() != 0 ? NULL : pFormResources, pPageResources)) {
         return FALSE;
     }
-    if (m_bpc == 0 || m_nComponents == 0) {
+    if (m_bDoBpcCheck && (m_bpc == 0 || m_nComponents == 0)) {
         return FALSE;
     }
     FX_SAFE_DWORD src_pitch =
@@ -211,7 +212,8 @@ FX_BOOL CPDF_DIBSource::Load(CPDF_Document* pDoc, const CPDF_Stream* pStream, CP
         return FALSE;
     }
     const CFX_ByteString& decoder = m_pStreamAcc->GetImageDecoder();
-    if (!decoder.IsEmpty() && decoder == FX_BSTRC("CCITTFaxDecode")) {
+    if (decoder == FX_BSTRC("CCITTFaxDecode")) {
+        m_bDoBpcCheck = TRUE;
         m_bpc = 1;

[Lei Zhang, 2015/02/07 08:39:11]

I don't have a test image, but I don't see how this can work given the |m_bpc|
check on line 201. So I modified LoadColorInfo() to skip the check for
"CCITTFaxDecode" as well.

In patch set 1, I suspected we can skip the check for JPX, CCITTFax, and JBIG2.
I didn't make the change for JBIG2, but I still suspect we need to.

     }
     if (!CreateDecoder()) {
@@ -316,7 +318,7 @@ int	CPDF_DIBSource::StartLoadDIBSource(CPDF_Document* pDoc, const CPDF_Stream* p
     if (!LoadColorInfo(m_pStream->GetObjNum() != 0 ? NULL : pFormResources, pPageResources)) {
         return 0;
     }
-    if (m_bpc == 0 || m_nComponents == 0) {
+    if (m_bDoBpcCheck && (m_bpc == 0 || m_nComponents == 0)) {
         return 0;
     }
     FX_SAFE_DWORD src_pitch =
@@ -329,6 +331,11 @@ int	CPDF_DIBSource::StartLoadDIBSource(CPDF_Document* pDoc, const CPDF_Stream* p
     if (m_pStreamAcc->GetSize() == 0 || m_pStreamAcc->GetData() == NULL) {
         return 0;
     }
+    const CFX_ByteString& decoder = m_pStreamAcc->GetImageDecoder();
+    if (decoder == FX_BSTRC("CCITTFaxDecode")) {
+        m_bDoBpcCheck = TRUE;
+        m_bpc = 1;
+    }
     int ret = CreateDecoder();
     if (ret != 1) {
         if (!ret) {
@@ -445,12 +452,16 @@ FX_BOOL CPDF_DIBSource::LoadColorInfo(CPDF_Dictionary* pFormResources, CPDF_Dict
                 CFX_ByteString filter;
                 if (pFilter->GetType() == PDFOBJ_NAME) {
                     filter = pFilter->GetString();
-                    if (filter == FX_BSTRC("JPXDecode")) {
+                    if (filter == FX_BSTRC("JPXDecode") ||
+                        filter == FX_BSTRC("CCITTFaxDecode")) {
+                        m_bDoBpcCheck = FALSE;
                         return TRUE;
                     }
                 } else if (pFilter->GetType() == PDFOBJ_ARRAY) {
                     CPDF_Array* pArray = (CPDF_Array*)pFilter;
-                    if (pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("JPXDecode")) {
+                    if (pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("JPXDecode") ||
+                        pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("CCITTFaxDecode")) {
+                        m_bDoBpcCheck = FALSE;
                         return TRUE;
                     }
                 }
@@ -560,7 +571,7 @@ int CPDF_DIBSource::CreateDecoder()
     if (decoder.IsEmpty()) {
         return 1;
     }
-    if (m_bpc == 0) {
+    if (m_bDoBpcCheck && m_bpc == 0) {
         return 0;
     }
     FX_LPCBYTE src_data = m_pStreamAcc->GetData();
@@ -889,7 +900,7 @@ void CPDF_DIBSource::LoadPalette()
 void CPDF_DIBSource::ValidateDictParam()
 {
     m_bpc = m_bpc_orig;
-	CPDF_Object * pFilter = m_pDict->GetElementValue(FX_BSTRC("Filter"));
+    CPDF_Object * pFilter = m_pDict->GetElementValue(FX_BSTRC("Filter"));
     if (pFilter) {
         if (pFilter->GetType() == PDFOBJ_NAME) {
             CFX_ByteString filter = pFilter->GetString();
@@ -902,7 +913,7 @@ void CPDF_DIBSource::ValidateDictParam()
             }
         } else if (pFilter->GetType() == PDFOBJ_ARRAY) {
             CPDF_Array *pArray = (CPDF_Array *)pFilter;
-            if (pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("CCITTFacDecode") ||
+            if (pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("CCITTFaxDecode") ||
                     pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("JBIG2Decode")) {
                 m_bpc = 1;
                 m_nComponents = 1;