Bound total pixels in JBig2 images to avoid overflows later.

Also make these private to ensure they aren't modified so as to
violate the bounds checks applied at creation time.

BUG=633002

Review-Url: https://codereview.chromium.org/2202013002

1 files changed, 11 insertions, 15 deletions

diff --git a/core/fxcodec/jbig2/JBig2_Image.h b/core/fxcodec/jbig2/JBig2_Image.h
index a18a95d596..f27b86e854 100644
--- a/core/fxcodec/jbig2/JBig2_Image.h
+++ b/core/fxcodec/jbig2/JBig2_Image.h
@@ -9,6 +9,8 @@
 
 #include "core/fxcodec/jbig2/JBig2_Define.h"
 
+struct FX_RECT;
+
 enum JBig2ComposeOp {
   JBIG2_COMPOSE_OR = 0,
   JBIG2_COMPOSE_AND = 1,
@@ -17,23 +19,21 @@ enum JBig2ComposeOp {
   JBIG2_COMPOSE_REPLACE = 4
 };
 
-struct FX_RECT;
 class CJBig2_Image {
  public:
   CJBig2_Image(int32_t w, int32_t h);
-
   CJBig2_Image(int32_t w, int32_t h, int32_t stride, uint8_t* pBuf);
-
   CJBig2_Image(const CJBig2_Image& im);
-
   ~CJBig2_Image();
 
-  FX_BOOL getPixel(int32_t x, int32_t y);
+  int32_t width() const { return m_nWidth; }
+  int32_t height() const { return m_nHeight; }
+  int32_t stride() const { return m_nStride; }
 
+  FX_BOOL getPixel(int32_t x, int32_t y);
   int32_t setPixel(int32_t x, int32_t y, FX_BOOL v);
 
   void copyLine(int32_t hTo, int32_t hFrom);
-
   void fill(FX_BOOL v);
 
   FX_BOOL composeTo(CJBig2_Image* pDst,
@@ -67,19 +67,15 @@ class CJBig2_Image {
                       const FX_RECT* pSrcRect);
 
   CJBig2_Image* subImage(int32_t x, int32_t y, int32_t w, int32_t h);
-
   void expand(int32_t h, FX_BOOL v);
 
- public:
-  int32_t m_nWidth;
-
-  int32_t m_nHeight;
-
-  int32_t m_nStride;
-
   uint8_t* m_pData;
 
-  FX_BOOL m_bNeedFree;
+ private:
+  int32_t m_nWidth;   // 1-bit pixels
+  int32_t m_nHeight;  // lines
+  int32_t m_nStride;  // bytes
+  bool m_bOwnsBuffer;
 };
 
 #endif  // CORE_FXCODEC_JBIG2_JBIG2_IMAGE_H_