Revert 'Remove almost all usages of CFX_FixedBufGrow with std::vector'chromium/3444

This is a manual revert of the CL at:
https://pdfium-review.googlesource.com/c/pdfium/+/32159

The only file manually changed was cpdf_renderstatus.cpp

Reason for revert: the bug below shows that sometimes the vector size
used is larger than the parameter given to CFX_FixedBufGrow. Thus, we
will revert, then add vectors using std::max unless it's clear from the
code that the code will never access indices outside.

Bug: chromium:847247
Change-Id: Iee54af023c8564824418a7d34a6385b0bc418ff0
Reviewed-on: https://pdfium-review.googlesource.com/33050
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Nicolás Peña Moreno <npm@chromium.org>

3 files changed, 58 insertions, 37 deletions

diff --git a/core/fpdfapi/page/cpdf_colorspace.cpp b/core/fpdfapi/page/cpdf_colorspace.cpp
index 354a342d90..31c485fe03 100644
--- a/core/fpdfapi/page/cpdf_colorspace.cpp
+++ b/core/fpdfapi/page/cpdf_colorspace.cpp
@@ -31,6 +31,7 @@
 #include "core/fpdfdoc/cpdf_action.h"
 #include "core/fxcodec/codec/ccodec_iccmodule.h"
 #include "core/fxcodec/fx_codec.h"
+#include "core/fxcrt/cfx_fixedbufgrow.h"
 #include "core/fxcrt/fx_memory.h"
 #include "core/fxcrt/maybe_owned.h"
 #include "third_party/base/stl_util.h"
@@ -573,7 +574,8 @@ void CPDF_ColorSpace::TranslateImageLine(uint8_t* dest_buf,
                                          int image_width,
                                          int image_height,
                                          bool bTransMask) const {
-  std::vector<float> src(m_nComponents);
+  CFX_FixedBufGrow<float, 16> srcbuf(m_nComponents);
+  float* src = srcbuf;
   float R;
   float G;
   float B;
@@ -581,7 +583,7 @@ void CPDF_ColorSpace::TranslateImageLine(uint8_t* dest_buf,
   for (int i = 0; i < pixels; i++) {
     for (uint32_t j = 0; j < m_nComponents; j++)
       src[j] = static_cast<float>(*src_buf++) / divisor;
-    GetRGB(src.data(), &R, &G, &B);
+    GetRGB(src, &R, &G, &B);
     *dest_buf++ = static_cast<int32_t>(B * 255);
     *dest_buf++ = static_cast<int32_t>(G * 255);
     *dest_buf++ = static_cast<int32_t>(R * 255);
@@ -1151,15 +1153,15 @@ bool CPDF_IndexedCS::GetRGB(const float* pBuf,
       return false;
     }
   }
-  std::vector<float> comps;
-  comps.reserve(m_nBaseComponents);
+  CFX_FixedBufGrow<float, 16> Comps(m_nBaseComponents);
+  float* comps = Comps;
   const uint8_t* pTable = m_Table.raw_str();
   for (uint32_t i = 0; i < m_nBaseComponents; i++) {
-    comps.push_back(m_pCompMinMax[i * 2] +
-                    m_pCompMinMax[i * 2 + 1] *
-                        pTable[index * m_nBaseComponents + i] / 255);
+    comps[i] =
+        m_pCompMinMax[i * 2] +
+        m_pCompMinMax[i * 2 + 1] * pTable[index * m_nBaseComponents + i] / 255;
   }
-  return m_pBaseCS->GetRGB(comps.data(), R, G, B);
+  return m_pBaseCS->GetRGB(comps, R, G, B);
 }
 
 void CPDF_IndexedCS::EnableStdConversion(bool bEnabled) {
@@ -1216,21 +1218,32 @@ bool CPDF_SeparationCS::GetRGB(const float* pBuf,
                                float* R,
                                float* G,
                                float* B) const {
-  if (m_Type == None || !m_pAltCS)
+  if (m_Type == None)
     return false;
 
   if (!m_pFunc) {
+    if (!m_pAltCS)
+      return false;
+
     int nComps = m_pAltCS->CountComponents();
-    std::vector<float> results(nComps, *pBuf);
-    return m_pAltCS->GetRGB(results.data(), R, G, B);
+    CFX_FixedBufGrow<float, 16> results(nComps);
+    for (int i = 0; i < nComps; i++)
+      results[i] = *pBuf;
+    return m_pAltCS->GetRGB(results, R, G, B);
   }
 
-  std::vector<float> results2(m_pFunc->CountOutputs());
+  CFX_FixedBufGrow<float, 16> results(m_pFunc->CountOutputs());
   int nresults = 0;
-  if (!m_pFunc->Call(pBuf, 1, results2.data(), &nresults) || nresults == 0)
+  if (!m_pFunc->Call(pBuf, 1, results, &nresults) || nresults == 0)
     return false;
 
-  return m_pAltCS->GetRGB(results2.data(), R, G, B);
+  if (m_pAltCS)
+    return m_pAltCS->GetRGB(results, R, G, B);
+
+  R = 0;
+  G = 0;
+  B = 0;
+  return false;
 }
 
 void CPDF_SeparationCS::EnableStdConversion(bool bEnabled) {
@@ -1285,14 +1298,14 @@ bool CPDF_DeviceNCS::GetRGB(const float* pBuf,
   if (!m_pFunc)
     return false;
 
-  std::vector<float> results(m_pFunc->CountOutputs());
+  CFX_FixedBufGrow<float, 16> results(m_pFunc->CountOutputs());
   int nresults = 0;
-  if (!m_pFunc->Call(pBuf, CountComponents(), results.data(), &nresults) ||
+  if (!m_pFunc->Call(pBuf, CountComponents(), results, &nresults) ||
       nresults == 0) {
     return false;
   }
 
-  return m_pAltCS->GetRGB(results.data(), R, G, B);
+  return m_pAltCS->GetRGB(results, R, G, B);
 }
 
 void CPDF_DeviceNCS::EnableStdConversion(bool bEnabled) {
diff --git a/core/fpdfapi/render/cpdf_dibsource.cpp b/core/fpdfapi/render/cpdf_dibsource.cpp
index ad828f2372..4241fb1b40 100644
--- a/core/fpdfapi/render/cpdf_dibsource.cpp
+++ b/core/fpdfapi/render/cpdf_dibsource.cpp
@@ -761,7 +761,8 @@ void CPDF_DIBSource::LoadPalette() {
   }
 
   int palette_count = 1 << (m_bpc * m_nComponents);
-  std::vector<float> color_value(m_nComponents);
+  CFX_FixedBufGrow<float, 16> color_values(m_nComponents);
+  float* color_value = color_values;
   for (int i = 0; i < palette_count; i++) {
     int color_data = i;
     for (uint32_t j = 0; j < m_nComponents; j++) {
@@ -778,11 +779,11 @@ void CPDF_DIBSource::LoadPalette() {
       int nComponents = m_pColorSpace->CountComponents();
       std::vector<float> temp_buf(nComponents);
       for (int k = 0; k < nComponents; k++) {
-        temp_buf[k] = color_value[0];
+        temp_buf[k] = *color_value;
       }
       m_pColorSpace->GetRGB(temp_buf.data(), &R, &G, &B);
     } else {
-      m_pColorSpace->GetRGB(color_value.data(), &R, &G, &B);
+      m_pColorSpace->GetRGB(color_value, &R, &G, &B);
     }
     SetPaletteArgb(i, ArgbEncode(255, FXSYS_round(R * 255),
                                  FXSYS_round(G * 255), FXSYS_round(B * 255)));
@@ -830,7 +831,8 @@ void CPDF_DIBSource::TranslateScanline24bpp(uint8_t* dest_scan,
   if (TranslateScanline24bppDefaultDecode(dest_scan, src_scan))
     return;
 
-  std::vector<float> color_values(m_nComponents);
+  CFX_FixedBufGrow<float, 16> color_values1(m_nComponents);
+  float* color_values = color_values1;
   float R = 0.0f;
   float G = 0.0f;
   float B = 0.0f;
@@ -858,7 +860,7 @@ void CPDF_DIBSource::TranslateScanline24bpp(uint8_t* dest_scan,
       G = (1.0f - color_values[1]) * k;
       B = (1.0f - color_values[2]) * k;
     } else if (m_Family != PDFCS_PATTERN) {
-      m_pColorSpace->GetRGB(color_values.data(), &R, &G, &B);
+      m_pColorSpace->GetRGB(color_values, &R, &G, &B);
     }
     R = pdfium::clamp(R, 0.0f, 1.0f);
     G = pdfium::clamp(G, 0.0f, 1.0f);
diff --git a/core/fpdfapi/render/cpdf_renderstatus.cpp b/core/fpdfapi/render/cpdf_renderstatus.cpp
index 8c3c8796e4..f99000bb69 100644
--- a/core/fpdfapi/render/cpdf_renderstatus.cpp
+++ b/core/fpdfapi/render/cpdf_renderstatus.cpp
@@ -49,6 +49,7 @@
 #include "core/fpdfapi/render/cpdf_type3cache.h"
 #include "core/fpdfdoc/cpdf_occontext.h"
 #include "core/fxcrt/autorestorer.h"
+#include "core/fxcrt/cfx_fixedbufgrow.h"
 #include "core/fxcrt/fx_safe_types.h"
 #include "core/fxcrt/maybe_owned.h"
 #include "core/fxge/cfx_defaultrenderdevice.h"
@@ -151,7 +152,9 @@ void DrawAxialShading(const RetainPtr<CFX_DIBitmap>& pBitmap,
   float y_span = end_y - start_y;
   float axis_len_square = (x_span * x_span) + (y_span * y_span);
 
-  std::vector<float> results(total_results);
+  CFX_FixedBufGrow<float, 16> result_array(total_results);
+  float* pResults = result_array;
+  memset(pResults, 0, total_results * sizeof(float));
   uint32_t rgb_array[kShadingSteps];
   for (int i = 0; i < kShadingSteps; i++) {
     float input = (t_max - t_min) * i / kShadingSteps + t_min;
@@ -159,14 +162,14 @@ void DrawAxialShading(const RetainPtr<CFX_DIBitmap>& pBitmap,
     for (const auto& func : funcs) {
       if (func) {
         int nresults = 0;
-        if (func->Call(&input, 1, results.data() + offset, &nresults))
+        if (func->Call(&input, 1, pResults + offset, &nresults))
           offset += nresults;
       }
     }
     float R = 0.0f;
     float G = 0.0f;
     float B = 0.0f;
-    pCS->GetRGB(results.data(), &R, &G, &B);
+    pCS->GetRGB(pResults, &R, &G, &B);
     rgb_array[i] =
         FXARGB_TODIB(FXARGB_MAKE(alpha, FXSYS_round(R * 255),
                                  FXSYS_round(G * 255), FXSYS_round(B * 255)));
@@ -235,7 +238,9 @@ void DrawRadialShading(const RetainPtr<CFX_DIBitmap>& pBitmap,
     bEndExtend = !!pArray->GetIntegerAt(1);
   }
 
-  std::vector<float> results(total_results);
+  CFX_FixedBufGrow<float, 16> result_array(total_results);
+  float* pResults = result_array;
+  memset(pResults, 0, total_results * sizeof(float));
   uint32_t rgb_array[kShadingSteps];
   for (int i = 0; i < kShadingSteps; i++) {
     float input = (t_max - t_min) * i / kShadingSteps + t_min;
@@ -243,14 +248,14 @@ void DrawRadialShading(const RetainPtr<CFX_DIBitmap>& pBitmap,
     for (const auto& func : funcs) {
       if (func) {
         int nresults;
-        if (func->Call(&input, 1, results.data() + offset, &nresults))
+        if (func->Call(&input, 1, pResults + offset, &nresults))
           offset += nresults;
       }
     }
     float R = 0.0f;
     float G = 0.0f;
     float B = 0.0f;
-    pCS->GetRGB(results.data(), &R, &G, &B);
+    pCS->GetRGB(pResults, &R, &G, &B);
     rgb_array[i] =
         FXARGB_TODIB(FXARGB_MAKE(alpha, FXSYS_round(R * 255),
                                  FXSYS_round(G * 255), FXSYS_round(B * 255)));
@@ -362,7 +367,9 @@ void DrawFuncShading(const RetainPtr<CFX_DIBitmap>& pBitmap,
   int height = pBitmap->GetHeight();
   int pitch = pBitmap->GetPitch();
 
-  std::vector<float> results(total_results);
+  CFX_FixedBufGrow<float, 16> result_array(total_results);
+  float* pResults = result_array;
+  memset(pResults, 0, total_results * sizeof(float));
   for (int row = 0; row < height; row++) {
     uint32_t* dib_buf = (uint32_t*)(pBitmap->GetBuffer() + row * pitch);
     for (int column = 0; column < width; column++) {
@@ -376,7 +383,7 @@ void DrawFuncShading(const RetainPtr<CFX_DIBitmap>& pBitmap,
       for (const auto& func : funcs) {
         if (func) {
           int nresults;
-          if (func->Call(input, 2, results.data() + offset, &nresults))
+          if (func->Call(input, 2, pResults + offset, &nresults))
             offset += nresults;
         }
       }
@@ -384,7 +391,7 @@ void DrawFuncShading(const RetainPtr<CFX_DIBitmap>& pBitmap,
       float R = 0.0f;
       float G = 0.0f;
       float B = 0.0f;
-      pCS->GetRGB(results.data(), &R, &G, &B);
+      pCS->GetRGB(pResults, &R, &G, &B);
       dib_buf[column] = FXARGB_TODIB(FXARGB_MAKE(
           alpha, (int32_t)(R * 255), (int32_t)(G * 255), (int32_t)(B * 255)));
     }
@@ -2049,14 +2056,13 @@ void CPDF_RenderStatus::DrawShading(const CPDF_ShadingPattern* pPattern,
     const CPDF_Array* pBackColor = pDict->GetArrayFor("Background");
     if (pBackColor &&
         pBackColor->GetCount() >= pColorSpace->CountComponents()) {
-      std::vector<float> comps;
-      comps.reserve(pColorSpace->CountComponents());
+      CFX_FixedBufGrow<float, 16> comps(pColorSpace->CountComponents());
       for (uint32_t i = 0; i < pColorSpace->CountComponents(); i++)
-        comps.push_back(pBackColor->GetNumberAt(i));
+        comps[i] = pBackColor->GetNumberAt(i);
       float R = 0.0f;
       float G = 0.0f;
       float B = 0.0f;
-      pColorSpace->GetRGB(comps.data(), &R, &G, &B);
+      pColorSpace->GetRGB(comps, &R, &G, &B);
       background = ArgbEncode(255, (int32_t)(R * 255), (int32_t)(G * 255),
                               (int32_t)(B * 255));
     }
@@ -2596,11 +2602,11 @@ RetainPtr<CFX_DIBitmap> CPDF_RenderStatus::LoadSMask(
   int src_pitch = bitmap.GetPitch();
   std::vector<uint8_t> transfers(256);
   if (pFunc) {
-    std::vector<float> results(pFunc->CountOutputs());
+    CFX_FixedBufGrow<float, 16> results(pFunc->CountOutputs());
     for (int i = 0; i < 256; i++) {
       float input = (float)i / 255.0f;
       int nresult;
-      pFunc->Call(&input, 1, results.data(), &nresult);
+      pFunc->Call(&input, 1, results, &nresult);
       transfers[i] = FXSYS_round(results[0] * 255);
     }
   } else {