Normalize widget bounding boxes when flattening.

BUG=chromium:890322

Change-Id: I11050b84cf440f8d6bb00c661360de4e389dc031
Reviewed-on: https://pdfium-review.googlesource.com/c/43290
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

4 files changed, 143 insertions, 0 deletions

diff --git a/fpdfsdk/fpdf_flatten.cpp b/fpdfsdk/fpdf_flatten.cpp
index 01f3cd7e1e..a27d79f09e 100644
--- a/fpdfsdk/fpdf_flatten.cpp
+++ b/fpdfsdk/fpdf_flatten.cpp
@@ -364,6 +364,7 @@ FPDF_EXPORT int FPDF_CALLCONV FPDFPage_Flatten(FPDF_PAGE page, int nFlag) {
       rcStream = pAPDic->GetRectFor("Rect");
     else if (pAPDic->KeyExist("BBox"))
       rcStream = pAPDic->GetRectFor("BBox");
+    rcStream.Normalize();
 
     if (rcStream.IsEmpty())
       continue;
diff --git a/fpdfsdk/fpdf_flatten_embeddertest.cpp b/fpdfsdk/fpdf_flatten_embeddertest.cpp
index a8915fe60c..c861d75711 100644
--- a/fpdfsdk/fpdf_flatten_embeddertest.cpp
+++ b/fpdfsdk/fpdf_flatten_embeddertest.cpp
@@ -37,3 +37,20 @@ TEST_F(FPDFFlattenEmbeddertest, FlatPrint) {
   EXPECT_EQ(FLATTEN_SUCCESS, FPDFPage_Flatten(page, FLAT_PRINT));
   UnloadPage(page);
 }
+
+TEST_F(FPDFFlattenEmbeddertest, BUG_890322) {
+  static const char md5_hash[] = "6c674642154408e877d88c6c082d67e9";
+  EXPECT_TRUE(OpenDocument("bug_890322.pdf"));
+  FPDF_PAGE page = LoadPage(0);
+  ASSERT_TRUE(page);
+
+  ScopedFPDFBitmap bitmap = RenderLoadedPageWithFlags(page, FPDF_ANNOT);
+  CompareBitmap(bitmap.get(), 200, 200, md5_hash);
+
+  EXPECT_EQ(FLATTEN_SUCCESS, FPDFPage_Flatten(page, FLAT_PRINT));
+  EXPECT_TRUE(FPDF_SaveAsCopy(document(), this, 0));
+
+  UnloadPage(page);
+
+  VerifySavedDocument(200, 200, md5_hash);
+}
diff --git a/testing/resources/bug_890322.in b/testing/resources/bug_890322.in
new file mode 100644
index 0000000000..ea55ac652f
--- /dev/null
+++ b/testing/resources/bug_890322.in
@@ -0,0 +1,56 @@
+{{header}}
+{{object 1 0}} <<
+  /Type /Catalog
+  /Pages 2 0 R
+  /AcroForm << /Fields [ 4 0 R ] >>
+>>
+endobj
+{{object 2 0}} <<
+  /Type /Pages /Count 1 /Kids [ 3 0 R ]
+>>
+endobj
+{{object 3 0}} <<
+  /Type /Page
+  /Parent 2 0 R
+  /MediaBox [ 0 0 200 200 ]
+  /Contents 6 0 R
+  /Annots [ 4 0 R ]
+>>
+endobj
+{{object 4 0}} <<
+  /Type /Annot
+  /Subtype /Widget
+  /F 4
+  /FT /Btn
+  /Rect [ 75 80 125 120 ]
+  /T (PushButton)
+  /Ff 65536
+  /H
+  /P
+  /AP << /N 5 0 R >>
+  /MK << /BG [ 1.0 0.0 0.0 ] >>
+>>
+endobj
+{{object 5 0}} <<
+  /Subtype /Form
+  /BBox [ 0 40 50 00 ]
+  {{streamlen}}
+>>
+stream
+q
+0 0 1 rg
+0 0 50 40 re B*
+Q
+endstream
+{{object 6 0}} <<
+  {{streamlen}}
+>>
+stream
+q
+Q
+endstream
+endobj
+{{xref}}
+{{trailer}}
+{{startxref}}
+%%EOF
diff --git a/testing/resources/bug_890322.pdf b/testing/resources/bug_890322.pdf
new file mode 100644
index 0000000000..2183aafeef
--- /dev/null
+++ b/testing/resources/bug_890322.pdf
@@ -0,0 +1,69 @@
+%PDF-1.7
+% ò¤ô
+1 0 obj <<
+  /Type /Catalog
+  /Pages 2 0 R
+  /AcroForm << /Fields [ 4 0 R ] >>
+>>
+endobj
+2 0 obj <<
+  /Type /Pages /Count 1 /Kids [ 3 0 R ]
+>>
+endobj
+3 0 obj <<
+  /Type /Page
+  /Parent 2 0 R
+  /MediaBox [ 0 0 200 200 ]
+  /Contents 6 0 R
+  /Annots [ 4 0 R ]
+>>
+endobj
+4 0 obj <<
+  /Type /Annot
+  /Subtype /Widget
+  /F 4
+  /FT /Btn
+  /Rect [ 75 80 125 120 ]
+  /T (PushButton)
+  /Ff 65536
+  /H
+  /P
+  /AP << /N 5 0 R >>
+  /MK << /BG [ 1.0 0.0 0.0 ] >>
+>>
+endobj
+5 0 obj <<
+  /Subtype /Form
+  /BBox [ 0 40 50 00 ]
+  /Length 29
+>>
+stream
+q
+0 0 1 rg
+0 0 50 40 re B*
+Q
+endstream
+6 0 obj <<
+  /Length 4
+>>
+stream
+q
+Q
+endstream
+endobj
+xref
+0 7
+0000000000 65535 f 
+0000000015 00000 n 
+0000000104 00000 n 
+0000000165 00000 n 
+0000000282 00000 n 
+0000000474 00000 n 
+0000000587 00000 n 
+trailer <<
+  /Root 1 0 R
+  /Size 7
+>>
+startxref
+641
+%%EOF