Use the right allocate and free functions in OpenJPEG.

This patch was authored by Ke Liu of Tencent's Xuanwu Lab.

BUG=762374

Change-Id: Icb3ee98fb4c399b871ccf11e9920af7caf51be11
Reviewed-on: https://pdfium-review.googlesource.com/13610
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Chris Palmer <palmer@chromium.org>

5 files changed, 69 insertions, 27 deletions

diff --git a/core/fxcodec/codec/fx_codec_jpx_opj.cpp b/core/fxcodec/codec/fx_codec_jpx_opj.cpp
index 007de0bdf3..b421e8fb2d 100644
--- a/core/fxcodec/codec/fx_codec_jpx_opj.cpp
+++ b/core/fxcodec/codec/fx_codec_jpx_opj.cpp
@@ -75,6 +75,7 @@ void sycc444_to_rgb(opj_image_t* img) {
       std::min({img->comps[0].h, img->comps[1].h, img->comps[2].h});
   FX_SAFE_SIZE_T max_size = maxw;
   max_size *= maxh;
+  max_size *= sizeof(int);
   if (!max_size.IsValid())
     return;
 
@@ -84,18 +85,19 @@ void sycc444_to_rgb(opj_image_t* img) {
   if (!y || !cb || !cr)
     return;
 
-  int* r = static_cast<int*>(opj_calloc(max_size.ValueOrDie(), sizeof(int)));
-  int* g = static_cast<int*>(opj_calloc(max_size.ValueOrDie(), sizeof(int)));
-  int* b = static_cast<int*>(opj_calloc(max_size.ValueOrDie(), sizeof(int)));
+  int* r = static_cast<int*>(opj_image_data_alloc(max_size.ValueOrDie()));
+  int* g = static_cast<int*>(opj_image_data_alloc(max_size.ValueOrDie()));
+  int* b = static_cast<int*>(opj_image_data_alloc(max_size.ValueOrDie()));
   int* d0 = r;
   int* d1 = g;
   int* d2 = b;
+  max_size /= sizeof(int);
   for (size_t i = 0; i < max_size.ValueOrDie(); ++i) {
     sycc_to_rgb(offset, upb, *y++, *cb++, *cr++, r++, g++, b++);
   }
-  opj_free(img->comps[0].data);
-  opj_free(img->comps[1].data);
-  opj_free(img->comps[2].data);
+  opj_image_data_free(img->comps[0].data);
+  opj_image_data_free(img->comps[1].data);
+  opj_image_data_free(img->comps[2].data);
   img->comps[0].data = d0;
   img->comps[1].data = d1;
   img->comps[2].data = d2;
@@ -132,6 +134,7 @@ void sycc422_to_rgb(opj_image_t* img) {
   OPJ_UINT32 maxh = img->comps[0].h;
   FX_SAFE_SIZE_T max_size = maxw;
   max_size *= maxh;
+  max_size *= sizeof(int);
   if (!max_size.IsValid())
     return;
 
@@ -141,9 +144,9 @@ void sycc422_to_rgb(opj_image_t* img) {
   if (!y || !cb || !cr)
     return;
 
-  int* r = static_cast<int*>(opj_calloc(max_size.ValueOrDie(), sizeof(int)));
-  int* g = static_cast<int*>(opj_calloc(max_size.ValueOrDie(), sizeof(int)));
-  int* b = static_cast<int*>(opj_calloc(max_size.ValueOrDie(), sizeof(int)));
+  int* r = static_cast<int*>(opj_image_data_alloc(max_size.ValueOrDie()));
+  int* g = static_cast<int*>(opj_image_data_alloc(max_size.ValueOrDie()));
+  int* b = static_cast<int*>(opj_image_data_alloc(max_size.ValueOrDie()));
   int* d0 = r;
   int* d1 = g;
   int* d2 = b;
@@ -157,9 +160,9 @@ void sycc422_to_rgb(opj_image_t* img) {
       sycc_to_rgb(offset, upb, *y++, *cb++, *cr++, r++, g++, b++);
     }
   }
-  opj_free(img->comps[0].data);
-  opj_free(img->comps[1].data);
-  opj_free(img->comps[2].data);
+  opj_image_data_free(img->comps[0].data);
+  opj_image_data_free(img->comps[1].data);
+  opj_image_data_free(img->comps[2].data);
   img->comps[0].data = d0;
   img->comps[1].data = d1;
   img->comps[2].data = d2;
@@ -308,12 +311,13 @@ void sycc420_to_rgb(opj_image_t* img) {
   bool exth = sycc420_must_extend_cbcr(yh, cbh);
   FX_SAFE_UINT32 safeSize = yw;
   safeSize *= yh;
+  safeSize *= sizeof(int);
   if (!safeSize.IsValid())
     return;
 
-  int* r = static_cast<int*>(opj_calloc(safeSize.ValueOrDie(), sizeof(int)));
-  int* g = static_cast<int*>(opj_calloc(safeSize.ValueOrDie(), sizeof(int)));
-  int* b = static_cast<int*>(opj_calloc(safeSize.ValueOrDie(), sizeof(int)));
+  int* r = static_cast<int*>(opj_image_data_alloc(safeSize.ValueOrDie()));
+  int* g = static_cast<int*>(opj_image_data_alloc(safeSize.ValueOrDie()));
+  int* b = static_cast<int*>(opj_image_data_alloc(safeSize.ValueOrDie()));
   int* d0 = r;
   int* d1 = g;
   int* d2 = b;
@@ -409,9 +413,9 @@ void sycc420_to_rgb(opj_image_t* img) {
     }
   }
 
-  opj_free(img->comps[0].data);
-  opj_free(img->comps[1].data);
-  opj_free(img->comps[2].data);
+  opj_image_data_free(img->comps[0].data);
+  opj_image_data_free(img->comps[1].data);
+  opj_image_data_free(img->comps[2].data);
   img->comps[0].data = d0;
   img->comps[1].data = d1;
   img->comps[2].data = d2;
diff --git a/core/fxcodec/codec/fx_codec_jpx_unittest.cpp b/core/fxcodec/codec/fx_codec_jpx_unittest.cpp
index cc5c8601b1..c1b20513cd 100644
--- a/core/fxcodec/codec/fx_codec_jpx_unittest.cpp
+++ b/core/fxcodec/codec/fx_codec_jpx_unittest.cpp
@@ -436,9 +436,12 @@ TEST(fxcodec, YUV420ToRGB) {
     y.h = y.w;
     img.x1 = y.w;
     img.y1 = y.h;
-    y.data = static_cast<OPJ_INT32*>(opj_calloc(y.w * y.h, sizeof(OPJ_INT32)));
-    v.data = static_cast<OPJ_INT32*>(opj_calloc(v.w * v.h, sizeof(OPJ_INT32)));
-    u.data = static_cast<OPJ_INT32*>(opj_calloc(u.w * u.h, sizeof(OPJ_INT32)));
+    y.data = static_cast<OPJ_INT32*>(
+        opj_image_data_alloc(y.w * y.h * sizeof(OPJ_INT32)));
+    v.data = static_cast<OPJ_INT32*>(
+        opj_image_data_alloc(v.w * v.h * sizeof(OPJ_INT32)));
+    u.data = static_cast<OPJ_INT32*>(
+        opj_image_data_alloc(u.w * u.h * sizeof(OPJ_INT32)));
     memset(y.data, 1, y.w * y.h * sizeof(OPJ_INT32));
     memset(u.data, 0, u.w * u.h * sizeof(OPJ_INT32));
     memset(v.data, 0, v.w * v.h * sizeof(OPJ_INT32));
@@ -457,9 +460,9 @@ TEST(fxcodec, YUV420ToRGB) {
       EXPECT_NE(img.comps[0].w, img.comps[2].w);
       EXPECT_NE(img.comps[0].h, img.comps[2].h);
     }
-    opj_free(img.comps[0].data);
-    opj_free(img.comps[1].data);
-    opj_free(img.comps[2].data);
+    opj_image_data_free(img.comps[0].data);
+    opj_image_data_free(img.comps[1].data);
+    opj_image_data_free(img.comps[2].data);
   }
   FX_Free(img.comps);
 }
diff --git a/third_party/libopenjpeg20/0035-opj_image_data_free.patch b/third_party/libopenjpeg20/0035-opj_image_data_free.patch
new file mode 100644
index 0000000000..8bd03a214e
--- /dev/null
+++ b/third_party/libopenjpeg20/0035-opj_image_data_free.patch
@@ -0,0 +1,35 @@
+diff --git a/third_party/libopenjpeg20/image.c b/third_party/libopenjpeg20/image.c
+index e29172b2b..bf7a70194 100644
+--- a/third_party/libopenjpeg20/image.c
++++ b/third_party/libopenjpeg20/image.c
+@@ -180,7 +180,7 @@ void opj_copy_image_header(const opj_image_t* p_image_src,
+         for (compno = 0; compno < p_image_dest->numcomps; compno++) {
+             opj_image_comp_t *image_comp = &(p_image_dest->comps[compno]);
+             if (image_comp->data) {
+-                opj_free(image_comp->data);
++                opj_image_data_free(image_comp->data);
+             }
+         }
+         opj_free(p_image_dest->comps);
+diff --git a/third_party/libopenjpeg20/jp2.c b/third_party/libopenjpeg20/jp2.c
+index 9178f3fd6..e7e2db8bb 100644
+--- a/third_party/libopenjpeg20/jp2.c
++++ b/third_party/libopenjpeg20/jp2.c
+@@ -1083,7 +1083,7 @@ static OPJ_BOOL opj_jp2_apply_pclr(opj_image_t *image,
+         if (!new_comps[i].data) {
+             while (i > 0) {
+                 -- i;
+-                opj_free(new_comps[i].data);
++                opj_image_data_free(new_comps[i].data);
+             }
+             opj_free(new_comps);
+             opj_event_msg(p_manager, EVT_ERROR,
+@@ -1107,7 +1107,7 @@ static OPJ_BOOL opj_jp2_apply_pclr(opj_image_t *image,
+         /* Prevent null pointer access */
+         if (!src || !dst) {
+           for (j = 0; j < nr_channels; ++j) {
+-            opj_free(new_comps[j].data);
++            opj_image_data_free(new_comps[j].data);
+           }
+           opj_free(new_comps);
+           new_comps = NULL;
diff --git a/third_party/libopenjpeg20/image.c b/third_party/libopenjpeg20/image.c
index e29172b2b5..bf7a701942 100644
--- a/third_party/libopenjpeg20/image.c
+++ b/third_party/libopenjpeg20/image.c
@@ -180,7 +180,7 @@ void opj_copy_image_header(const opj_image_t* p_image_src,
         for (compno = 0; compno < p_image_dest->numcomps; compno++) {
             opj_image_comp_t *image_comp = &(p_image_dest->comps[compno]);
             if (image_comp->data) {
-                opj_free(image_comp->data);
+                opj_image_data_free(image_comp->data);
             }
         }
         opj_free(p_image_dest->comps);
diff --git a/third_party/libopenjpeg20/jp2.c b/third_party/libopenjpeg20/jp2.c
index 9178f3fd63..e7e2db8bb4 100644
--- a/third_party/libopenjpeg20/jp2.c
+++ b/third_party/libopenjpeg20/jp2.c
@@ -1083,7 +1083,7 @@ static OPJ_BOOL opj_jp2_apply_pclr(opj_image_t *image,
         if (!new_comps[i].data) {
             while (i > 0) {
                 -- i;
-                opj_free(new_comps[i].data);
+                opj_image_data_free(new_comps[i].data);
             }
             opj_free(new_comps);
             opj_event_msg(p_manager, EVT_ERROR,
@@ -1107,7 +1107,7 @@ static OPJ_BOOL opj_jp2_apply_pclr(opj_image_t *image,
         /* Prevent null pointer access */
         if (!src || !dst) {
           for (j = 0; j < nr_channels; ++j) {
-            opj_free(new_comps[j].data);
+            opj_image_data_free(new_comps[j].data);
           }
           opj_free(new_comps);
           new_comps = NULL;