Let CPDF_MeshStream::ReadVertexRow return a vector

In this CL, CPDF_MeshStream::ReadVertexRow returns a vector. The vector
size is not allocated in advance to prevent OOM attacks, since the size
is given as an input to the PDF.

Bug: chromium:735248
Change-Id: I3e2b020896f24715af5dfd9aa18768e6d64d6f76
Reviewed-on: https://pdfium-review.googlesource.com/7950
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>

1 files changed, 10 insertions, 11 deletions

diff --git a/core/fpdfapi/render/cpdf_renderstatus.cpp b/core/fpdfapi/render/cpdf_renderstatus.cpp
index ccbe39ea07..e033f26093 100644
--- a/core/fpdfapi/render/cpdf_renderstatus.cpp
+++ b/core/fpdfapi/render/cpdf_renderstatus.cpp
@@ -527,25 +527,24 @@ void DrawLatticeGouraudShading(
   if (!stream.Load())
     return;
 
-  std::unique_ptr<CPDF_MeshVertex, FxFreeDeleter> vertex(
-      FX_Alloc2D(CPDF_MeshVertex, row_verts, 2));
-  if (!stream.ReadVertexRow(*pObject2Bitmap, row_verts, vertex.get()))
+  std::vector<CPDF_MeshVertex> vertices[2];
+  vertices[0] = stream.ReadVertexRow(*pObject2Bitmap, row_verts);
+  if (vertices[0].empty())
     return;
 
   int last_index = 0;
   while (1) {
-    CPDF_MeshVertex* last_row = vertex.get() + last_index * row_verts;
-    CPDF_MeshVertex* this_row = vertex.get() + (1 - last_index) * row_verts;
-    if (!stream.ReadVertexRow(*pObject2Bitmap, row_verts, this_row))
+    vertices[1 - last_index] = stream.ReadVertexRow(*pObject2Bitmap, row_verts);
+    if (vertices[1 - last_index].empty())
       return;
 
     CPDF_MeshVertex triangle[3];
-    for (int i = 1; i < row_verts; i++) {
-      triangle[0] = last_row[i];
-      triangle[1] = this_row[i - 1];
-      triangle[2] = last_row[i - 1];
+    for (int i = 1; i < row_verts; ++i) {
+      triangle[0] = vertices[last_index][i];
+      triangle[1] = vertices[1 - last_index][i - 1];
+      triangle[2] = vertices[last_index][i - 1];
       DrawGouraud(pBitmap, alpha, triangle);
-      triangle[2] = this_row[i];
+      triangle[2] = vertices[1 - last_index][i];
       DrawGouraud(pBitmap, alpha, triangle);
     }
     last_index = 1 - last_index;