Fix crash when creating a CFX_DIBitmap with FXDIB_Invalid.

Bug: chromium:820885
Change-Id: I3886c636b91a8499924d95ad47f4c832db9f9754
Reviewed-on: https://pdfium-review.googlesource.com/28491
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Henrique Nakashima <hnakashima@chromium.org>

2 files changed, 19 insertions, 1 deletions

diff --git a/core/fxge/dib/cfx_dibitmap.cpp b/core/fxge/dib/cfx_dibitmap.cpp
index 857ca9a3ce..a9764e7550 100644
--- a/core/fxge/dib/cfx_dibitmap.cpp
+++ b/core/fxge/dib/cfx_dibitmap.cpp
@@ -819,7 +819,10 @@ bool CFX_DIBitmap::CalculatePitchAndSize(int height,
   if (width <= 0 || height <= 0)
     return false;
 
-  if ((INT_MAX - 31) / width < (format & 0xFF))
+  if (!(format & 0xff))
+    return false;
+
+  if ((INT_MAX - 31) / width < (format & 0xff))
     return false;
 
   if (!*pitch)
diff --git a/core/fxge/dib/cfx_dibitmap_unittest.cpp b/core/fxge/dib/cfx_dibitmap_unittest.cpp
new file mode 100644
index 0000000000..67ca7055a3
--- /dev/null
+++ b/core/fxge/dib/cfx_dibitmap_unittest.cpp
@@ -0,0 +1,15 @@
+// Copyright 2018 PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/fxge/dib/cfx_dibitmap.h"
+
+#include "testing/gtest/include/gtest/gtest.h"
+
+TEST(CFX_DIBitmap, Create) {
+  auto pBitmap = pdfium::MakeRetain<CFX_DIBitmap>();
+  EXPECT_FALSE(pBitmap->Create(400, 300, FXDIB_Invalid));
+
+  pBitmap = pdfium::MakeRetain<CFX_DIBitmap>();
+  EXPECT_TRUE(pBitmap->Create(400, 300, FXDIB_1bppRgb));
+}