From 246221724a106c11481eedbf1f94475afba23569 Mon Sep 17 00:00:00 2001
From: thestig <thestig@chromium.org>
Date: Fri, 29 Jul 2016 13:38:54 -0700
Subject: Fix a FPE in CStretchEngine::StartStretchHorz().

Do some cleanup in the process.

BUG=629839

Review-Url: https://codereview.chromium.org/2190283003
---
 core/fxge/dib/dib_int.h         | 20 +++++++-----
 core/fxge/dib/fx_dib_engine.cpp | 67 +++++++++++++++++++++++------------------
 2 files changed, 51 insertions(+), 36 deletions(-)

diff --git a/core/fxge/dib/dib_int.h b/core/fxge/dib/dib_int.h
index 415362d51d..61533baf2c 100644
--- a/core/fxge/dib/dib_int.h
+++ b/core/fxge/dib/dib_int.h
@@ -60,6 +60,7 @@ class CWeightTable {
   int m_DestMin, m_ItemSize;
   uint8_t* m_pWeightTables;
 };
+
 class CStretchEngine {
  public:
   CStretchEngine(IFX_ScanlineComposer* pDestBitmap,
@@ -70,11 +71,17 @@ class CStretchEngine {
                  const CFX_DIBSource* pSrcBitmap,
                  int flags);
   ~CStretchEngine();
+
   FX_BOOL Continue(IFX_Pause* pPause);
 
- public:
+  FX_BOOL StartStretchHorz();
+  FX_BOOL ContinueStretchHorz(IFX_Pause* pPause);
+  void StretchVert();
+
   FXDIB_Format m_DestFormat;
-  int m_DestBpp, m_SrcBpp, m_bHasAlpha;
+  int m_DestBpp;
+  int m_SrcBpp;
+  int m_bHasAlpha;
   IFX_ScanlineComposer* m_pDestBitmap;
   int m_DestWidth, m_DestHeight;
   FX_RECT m_DestClip;
@@ -83,8 +90,10 @@ class CStretchEngine {
   FX_RECT m_SrcClip;
   const CFX_DIBSource* m_pSource;
   uint32_t* m_pSrcPalette;
-  int m_SrcWidth, m_SrcHeight;
-  int m_SrcPitch, m_InterPitch;
+  int m_SrcWidth;
+  int m_SrcHeight;
+  int m_SrcPitch;
+  int m_InterPitch;
   int m_ExtraMaskPitch;
   uint8_t* m_pInterBuf;
   uint8_t* m_pExtraAlphaBuf;
@@ -92,9 +101,6 @@ class CStretchEngine {
   int m_Flags;
   CWeightTable m_WeightTable;
   int m_CurRow;
-  FX_BOOL StartStretchHorz();
-  FX_BOOL ContinueStretchHorz(IFX_Pause* pPause);
-  void StretchVert();
   int m_State;
 };
 
diff --git a/core/fxge/dib/fx_dib_engine.cpp b/core/fxge/dib/fx_dib_engine.cpp
index 6df51d27c0..1b80ed453b 100644
--- a/core/fxge/dib/fx_dib_engine.cpp
+++ b/core/fxge/dib/fx_dib_engine.cpp
@@ -233,6 +233,7 @@ void CWeightTable::Calc(int dest_len,
     }
   }
 }
+
 CStretchEngine::CStretchEngine(IFX_ScanlineComposer* pDestBitmap,
                                FXDIB_Format dest_format,
                                int dest_width,
@@ -344,6 +345,14 @@ CStretchEngine::CStretchEngine(IFX_ScanlineComposer* pDestBitmap,
     }
   }
 }
+
+CStretchEngine::~CStretchEngine() {
+  FX_Free(m_pDestScanline);
+  FX_Free(m_pInterBuf);
+  FX_Free(m_pExtraAlphaBuf);
+  FX_Free(m_pDestMaskScanline);
+}
+
 FX_BOOL CStretchEngine::Continue(IFX_Pause* pPause) {
   while (m_State == 1) {
     if (ContinueStretchHorz(pPause)) {
@@ -354,57 +363,56 @@ FX_BOOL CStretchEngine::Continue(IFX_Pause* pPause) {
   }
   return FALSE;
 }
-CStretchEngine::~CStretchEngine() {
-  FX_Free(m_pDestScanline);
-  FX_Free(m_pInterBuf);
-  FX_Free(m_pExtraAlphaBuf);
-  FX_Free(m_pDestMaskScanline);
-}
+
 FX_BOOL CStretchEngine::StartStretchHorz() {
-  if (m_DestWidth == 0 || !m_pDestScanline ||
-      m_SrcClip.Height() > (int)((1U << 29) / m_InterPitch) ||
-      m_SrcClip.Height() == 0) {
+  if (m_DestWidth == 0 || m_InterPitch == 0 || !m_pDestScanline)
+    return FALSE;
+
+  if (m_SrcClip.Height() == 0 ||
+      m_SrcClip.Height() > (1 << 29) / m_InterPitch) {
     return FALSE;
   }
+
   m_pInterBuf = FX_TryAlloc(unsigned char, m_SrcClip.Height() * m_InterPitch);
-  if (!m_pInterBuf) {
+  if (!m_pInterBuf)
     return FALSE;
-  }
+
   if (m_pSource && m_bHasAlpha && m_pSource->m_pAlphaMask) {
     m_pExtraAlphaBuf =
         FX_Alloc2D(unsigned char, m_SrcClip.Height(), m_ExtraMaskPitch);
     uint32_t size = (m_DestClip.Width() * 8 + 31) / 32 * 4;
     m_pDestMaskScanline = FX_TryAlloc(unsigned char, size);
-    if (!m_pDestMaskScanline) {
+    if (!m_pDestMaskScanline)
       return FALSE;
-    }
   }
   m_WeightTable.Calc(m_DestWidth, m_DestClip.left, m_DestClip.right, m_SrcWidth,
                      m_SrcClip.left, m_SrcClip.right, m_Flags);
-  if (!m_WeightTable.m_pWeightTables) {
+  if (!m_WeightTable.m_pWeightTables)
     return FALSE;
-  }
+
   m_CurRow = m_SrcClip.top;
   m_State = 1;
   return TRUE;
 }
-#define FX_STRECH_PAUSE_ROWS 10
+
 FX_BOOL CStretchEngine::ContinueStretchHorz(IFX_Pause* pPause) {
-  if (!m_DestWidth) {
-    return 0;
-  }
-  if (m_pSource->SkipToScanline(m_CurRow, pPause)) {
+  if (!m_DestWidth)
+    return FALSE;
+
+  if (m_pSource->SkipToScanline(m_CurRow, pPause))
     return TRUE;
-  }
+
   int Bpp = m_DestBpp / 8;
-  int rows_to_go = FX_STRECH_PAUSE_ROWS;
+  static const int kStrechPauseRows = 10;
+  int rows_to_go = kStrechPauseRows;
   for (; m_CurRow < m_SrcClip.bottom; m_CurRow++) {
     if (rows_to_go == 0) {
-      if (pPause && pPause->NeedToPauseNow()) {
+      if (pPause && pPause->NeedToPauseNow())
         return TRUE;
-      }
-      rows_to_go = FX_STRECH_PAUSE_ROWS;
+
+      rows_to_go = kStrechPauseRows;
     }
+
     const uint8_t* src_scan = m_pSource->GetScanline(m_CurRow);
     uint8_t* dest_scan =
         m_pInterBuf + (m_CurRow - m_SrcClip.top) * m_InterPitch;
@@ -618,16 +626,17 @@ FX_BOOL CStretchEngine::ContinueStretchHorz(IFX_Pause* pPause) {
   }
   return FALSE;
 }
+
 void CStretchEngine::StretchVert() {
-  if (m_DestHeight == 0) {
+  if (m_DestHeight == 0)
     return;
-  }
+
   CWeightTable table;
   table.Calc(m_DestHeight, m_DestClip.top, m_DestClip.bottom, m_SrcHeight,
              m_SrcClip.top, m_SrcClip.bottom, m_Flags);
-  if (!table.m_pWeightTables) {
+  if (!table.m_pWeightTables)
     return;
-  }
+
   int DestBpp = m_DestBpp / 8;
   for (int row = m_DestClip.top; row < m_DestClip.bottom; row++) {
     unsigned char* dest_scan = m_pDestScanline;
-- 
cgit v1.2.3