1 files changed, 6 insertions, 12 deletions
diff --git a/core/src/fpdfapi/fpdf_edit/fpdf_edit_image.cpp b/core/src/fpdfapi/fpdf_edit/fpdf_edit_image.cpp
index 1328fcdf96..a5a91ebc53 100644
--- a/core/src/fpdfapi/fpdf_edit/fpdf_edit_image.cpp
+++ b/core/src/fpdfapi/fpdf_edit/fpdf_edit_image.cpp
@@ -71,17 +71,11 @@ void CPDF_Image::SetJpegImage(IFX_FileRead *pFile)
         dwEstimateSize = 8192;
     }
     FX_LPBYTE pData = FX_Alloc(FX_BYTE, dwEstimateSize);
-    if (!pData) {
-        return;
-    }
     pFile->ReadBlock(pData, 0, dwEstimateSize);
     CPDF_Dictionary *pDict = InitJPEG(pData, dwEstimateSize);
     FX_Free(pData);
     if (!pDict && size > dwEstimateSize) {
         pData = FX_Alloc(FX_BYTE, size);
-        if (!pData) {
-            return;
-        }
         pFile->ReadBlock(pData, 0, size);
         pDict = InitJPEG(pData, size);
         FX_Free(pData);
@@ -223,8 +217,8 @@ void CPDF_Image::SetImage(const CFX_DIBitmap* pBitmap, FX_INT32 iCompress, IFX_F
         } else if (pMaskBitmap->GetFormat() == FXDIB_1bppMask) {
             _JBIG2EncodeBitmap(pMaskDict, pMaskBitmap, m_pDocument, mask_buf, mask_size, TRUE);
         } else {
-            mask_size = maskHeight * maskWidth;
-            mask_buf = FX_Alloc(FX_BYTE, mask_size);
+            mask_buf = FX_Alloc2D(FX_BYTE, maskHeight, maskWidth);
+            mask_size = maskHeight * maskWidth;  // Safe since checked alloc returned.
             for (FX_INT32 a = 0; a < maskHeight; a ++) {
                 FXSYS_memcpy32(mask_buf + a * maskWidth, pMaskBitmap->GetScanline(a), maskWidth);
             }
@@ -306,8 +300,8 @@ void CPDF_Image::SetImage(const CFX_DIBitmap* pBitmap, FX_INT32 iCompress, IFX_F
         }
     } else if (opType == 1) {
         if (!bStream) {
-            dest_size = dest_pitch * BitmapHeight;
-            dest_buf = FX_Alloc(FX_BYTE, dest_size);
+            dest_buf = FX_Alloc2D(FX_BYTE, dest_pitch, BitmapHeight);
+            dest_size = dest_pitch * BitmapHeight;  // Safe since checked alloc returned.
         }
         FX_LPBYTE pDest = dest_buf;
         for (FX_INT32 i = 0; i < BitmapHeight; i ++) {
@@ -321,8 +315,8 @@ void CPDF_Image::SetImage(const CFX_DIBitmap* pBitmap, FX_INT32 iCompress, IFX_F
         }
     } else if (opType == 2) {
         if (!bStream) {
-            dest_size = dest_pitch * BitmapHeight;
-            dest_buf = FX_Alloc(FX_BYTE, dest_size);
+            dest_buf = FX_Alloc2D(FX_BYTE, dest_pitch, BitmapHeight);
+            dest_size = dest_pitch * BitmapHeight;  // Safe since checked alloc returned.
         } else {
             dest_buf = FX_Alloc(FX_BYTE, dest_pitch);
         }