summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--core/fpdfapi/page/cpdf_streamparser.cpp47
1 files changed, 21 insertions, 26 deletions
diff --git a/core/fpdfapi/page/cpdf_streamparser.cpp b/core/fpdfapi/page/cpdf_streamparser.cpp
index 88b3993327..a64e14d741 100644
--- a/core/fpdfapi/page/cpdf_streamparser.cpp
+++ b/core/fpdfapi/page/cpdf_streamparser.cpp
@@ -29,6 +29,7 @@
#include "core/fpdfapi/parser/fpdf_parser_utility.h"
#include "core/fxcodec/codec/ccodec_jpegmodule.h"
#include "core/fxcodec/codec/ccodec_scanlinedecoder.h"
+#include "core/fxcodec/fx_codec.h"
#include "core/fxcrt/fx_extension.h"
namespace {
@@ -36,27 +37,26 @@ namespace {
const uint32_t kMaxNestedParsingLevel = 512;
const size_t kMaxStringLength = 32767;
-uint32_t DecodeAllScanlines(std::unique_ptr<CCodec_ScanlineDecoder> pDecoder,
- uint8_t** dest_buf,
- uint32_t* dest_size) {
+uint32_t DecodeAllScanlines(std::unique_ptr<CCodec_ScanlineDecoder> pDecoder) {
if (!pDecoder)
return FX_INVALID_OFFSET;
+
int ncomps = pDecoder->CountComps();
int bpc = pDecoder->GetBPC();
int width = pDecoder->GetWidth();
int height = pDecoder->GetHeight();
- int pitch = (width * ncomps * bpc + 7) / 8;
- if (height == 0 || pitch > (1 << 30) / height)
+ if (width <= 0 || height <= 0)
+ return FX_INVALID_OFFSET;
+
+ FX_SAFE_UINT32 size = CalculatePitch8(bpc, ncomps, width);
+ size *= height;
+ if (size.ValueOrDefault(0) == 0)
return FX_INVALID_OFFSET;
- *dest_buf = FX_Alloc2D(uint8_t, pitch, height);
- *dest_size = pitch * height; // Safe since checked alloc returned.
for (int row = 0; row < height; ++row) {
- const uint8_t* pLine = pDecoder->GetScanline(row);
- if (!pLine)
+ if (!pDecoder->GetScanline(row))
break;
- memcpy(*dest_buf + row * pitch, pLine, pitch);
}
return pDecoder->GetSrcOffset();
}
@@ -66,38 +66,36 @@ uint32_t DecodeInlineStream(pdfium::span<const uint8_t> src_span,
int height,
const ByteString& decoder,
CPDF_Dictionary* pParam,
- uint8_t** dest_buf,
- uint32_t* dest_size) {
- *dest_buf = nullptr;
- *dest_size = 0;
+ uint32_t orig_size) {
std::unique_ptr<uint8_t, FxFreeDeleter> ignored_result;
+ uint32_t ignored_size;
if (decoder == "FlateDecode" || decoder == "Fl") {
- return FlateOrLZWDecode(false, src_span, pParam, *dest_size,
- &ignored_result, dest_size);
+ return FlateOrLZWDecode(false, src_span, pParam, orig_size, &ignored_result,
+ &ignored_size);
}
if (decoder == "LZWDecode" || decoder == "LZW") {
return FlateOrLZWDecode(true, src_span, pParam, 0, &ignored_result,
- dest_size);
+ &ignored_size);
}
if (decoder == "DCTDecode" || decoder == "DCT") {
std::unique_ptr<CCodec_ScanlineDecoder> pDecoder =
CPDF_ModuleMgr::Get()->GetJpegModule()->CreateDecoder(
src_span, width, height, 0,
!pParam || pParam->GetIntegerFor("ColorTransform", 1));
- return DecodeAllScanlines(std::move(pDecoder), dest_buf, dest_size);
+ return DecodeAllScanlines(std::move(pDecoder));
}
if (decoder == "CCITTFaxDecode" || decoder == "CCF") {
std::unique_ptr<CCodec_ScanlineDecoder> pDecoder =
CreateFaxDecoder(src_span, width, height, pParam);
- return DecodeAllScanlines(std::move(pDecoder), dest_buf, dest_size);
+ return DecodeAllScanlines(std::move(pDecoder));
}
if (decoder == "ASCII85Decode" || decoder == "A85")
- return A85Decode(src_span, &ignored_result, dest_size);
+ return A85Decode(src_span, &ignored_result, &ignored_size);
if (decoder == "ASCIIHexDecode" || decoder == "AHx")
- return HexDecode(src_span, &ignored_result, dest_size);
+ return HexDecode(src_span, &ignored_result, &ignored_size);
if (decoder == "RunLengthDecode" || decoder == "RL")
- return RunLengthDecode(src_span, &ignored_result, dest_size);
+ return RunLengthDecode(src_span, &ignored_result, &ignored_size);
return FX_INVALID_OFFSET;
}
@@ -186,11 +184,8 @@ std::unique_ptr<CPDF_Stream> CPDF_StreamParser::ReadInlineStream(
dwStreamSize = OrigSize;
m_Pos += OrigSize;
} else {
- uint8_t* pIgnore = nullptr;
- uint32_t dwDestSize = OrigSize;
dwStreamSize = DecodeInlineStream(m_pBuf.subspan(m_Pos), width, height,
- Decoder, pParam, &pIgnore, &dwDestSize);
- FX_Free(pIgnore);
+ Decoder, pParam, OrigSize);
if (static_cast<int>(dwStreamSize) < 0)
return nullptr;