From 4f70b53efb39e9b9b868d99999582282be57fe50 Mon Sep 17 00:00:00 2001
From: dsinclair <dsinclair@chromium.org>
Date: Thu, 21 Apr 2016 10:54:40 -0700
Subject: Only call shading code with streams.

There are 4 types of meshes that attempt to convert the shading object into
a stream. According to spec (section 8.7.4.1 table 76), the shading object can
be a stream or a dictionary.

All of this shading code assumes it can load the mesh from a stream. The
original code just early exited if it was not a stream. We skip the call
if it is not a stream.

BUG=pdfium:481

Review URL: https://codereview.chromium.org/1908903003
---
 DEPS                                             |  2 +-
 core/fpdfapi/fpdf_render/fpdf_render_pattern.cpp | 30 ++++++++++++++++--------
 2 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/DEPS b/DEPS
index 8005526c37..855dfe2349 100644
--- a/DEPS
+++ b/DEPS
@@ -11,7 +11,7 @@ vars = {
   'gmock_revision': '29763965ab52f24565299976b936d1265cb6a271',
   'gtest_revision': '8245545b6dc9c4703e6496d1efd19e975ad2b038',
   'icu_revision': 'c291cde264469b20ca969ce8832088acb21e0c48',
-  'pdfium_tests_revision': '7ef8719fac859e1d23d667d4c3038ae8b38e4d36',
+  'pdfium_tests_revision': '7e5050a49256a7350df9b8d7ad86e911eb83c021',
   'skia_revision': '0a291c7b7eea1807bd58bdaa60c258fd0ebeb257',
   'trace_event_revision': 'd83d44b13d07c2fd0a40101a7deef9b93b841732',
   'v8_revision': '47bcec782b752ba411bd8bba6e390d1cc1c3226e',
diff --git a/core/fpdfapi/fpdf_render/fpdf_render_pattern.cpp b/core/fpdfapi/fpdf_render/fpdf_render_pattern.cpp
index 6ac380e43a..c235fd98cb 100644
--- a/core/fpdfapi/fpdf_render/fpdf_render_pattern.cpp
+++ b/core/fpdfapi/fpdf_render/fpdf_render_pattern.cpp
@@ -889,21 +889,31 @@ void CPDF_RenderStatus::DrawShading(CPDF_ShadingPattern* pPattern,
                         pColorSpace, alpha);
       break;
     case kFreeFormGouraudTriangleMeshShading: {
-      DrawFreeGouraudShading(pBitmap, &FinalMatrix,
-                             ToStream(pPattern->m_pShadingObj), pFuncs, nFuncs,
-                             pColorSpace, alpha);
+      // The shading object can be a stream or a dictionary. We do not handle
+      // the case of dictionary at the moment.
+      if (CPDF_Stream* pStream = ToStream(pPattern->m_pShadingObj)) {
+        DrawFreeGouraudShading(pBitmap, &FinalMatrix, pStream, pFuncs, nFuncs,
+                               pColorSpace, alpha);
+      }
     } break;
     case kLatticeFormGouraudTriangleMeshShading: {
-      DrawLatticeGouraudShading(pBitmap, &FinalMatrix,
-                                ToStream(pPattern->m_pShadingObj), pFuncs,
-                                nFuncs, pColorSpace, alpha);
+      // The shading object can be a stream or a dictionary. We do not handle
+      // the case of dictionary at the moment.
+      if (CPDF_Stream* pStream = ToStream(pPattern->m_pShadingObj)) {
+        DrawLatticeGouraudShading(pBitmap, &FinalMatrix, pStream, pFuncs,
+                                  nFuncs, pColorSpace, alpha);
+      }
     } break;
     case kCoonsPatchMeshShading:
     case kTensorProductPatchMeshShading: {
-      DrawCoonPatchMeshes(
-          pPattern->m_ShadingType == kTensorProductPatchMeshShading, pBitmap,
-          &FinalMatrix, ToStream(pPattern->m_pShadingObj), pFuncs, nFuncs,
-          pColorSpace, fill_mode, alpha);
+      // The shading object can be a stream or a dictionary. We do not handle
+      // the case of dictionary at the moment.
+      if (CPDF_Stream* pStream = ToStream(pPattern->m_pShadingObj)) {
+        DrawCoonPatchMeshes(
+            pPattern->m_ShadingType == kTensorProductPatchMeshShading, pBitmap,
+            &FinalMatrix, pStream, pFuncs, nFuncs, pColorSpace, fill_mode,
+            alpha);
+      }
     } break;
   }
   if (bAlphaMode) {
-- 
cgit v1.2.3