From cfd56852b6375d2b4eea473399231caf7dcdbf36 Mon Sep 17 00:00:00 2001
From: Lei Zhang <thestig@chromium.org>
Date: Thu, 18 May 2017 00:50:14 -0700
Subject: Fix a situation where images are not properly rendered.

This regressed in commit e21fe98. When the image's bpc is a multiple of
8, there exists a colorspace, and there is a Decode parameter, the image
data source was incorrectly pointing to a data structure that only
contained black pixels.

BUG=chromium:718762

Change-Id: I5d3fa739e41726b4ed1ebc16465e17f83fff9f8d
Reviewed-on: https://pdfium-review.googlesource.com/5333
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>
---
 core/fpdfapi/render/cpdf_dibsource.cpp             |  14 ++---
 testing/resources/pixel/bug_718762.in              |  67 +++++++++++++++++++++
 .../resources/pixel/bug_718762_expected.pdf.0.png  | Bin 0 -> 211 bytes
 3 files changed, 73 insertions(+), 8 deletions(-)
 create mode 100644 testing/resources/pixel/bug_718762.in
 create mode 100644 testing/resources/pixel/bug_718762_expected.pdf.0.png

diff --git a/core/fpdfapi/render/cpdf_dibsource.cpp b/core/fpdfapi/render/cpdf_dibsource.cpp
index f6009674c5..f1c58038e8 100644
--- a/core/fpdfapi/render/cpdf_dibsource.cpp
+++ b/core/fpdfapi/render/cpdf_dibsource.cpp
@@ -1361,7 +1361,7 @@ void CPDF_DIBSource::DownSampleScanline32Bit(int orig_Bpp,
     if (src_x == last_src_x) {
       argb = last_argb;
     } else {
-      CFX_FixedBufGrow<uint8_t, 128> extracted_components(m_nComponents);
+      CFX_FixedBufGrow<uint8_t, 16> extracted_components(m_nComponents);
       const uint8_t* pSrcPixel = nullptr;
       if (m_bpc % 8 != 0) {
         // No need to check for 32-bit overflow, as |src_x| is bounded by
@@ -1388,12 +1388,9 @@ void CPDF_DIBSource::DownSampleScanline32Bit(int orig_Bpp,
       if (m_pColorSpace) {
         uint8_t color[4];
         const bool bTransMask = TransMask();
-        if (m_bDefaultDecode) {
-          m_pColorSpace->TranslateImageLine(color, pSrcPixel, 1, 0, 0,
-                                            bTransMask);
-        } else {
+        if (!m_bDefaultDecode) {
           for (uint32_t j = 0; j < m_nComponents; ++j) {
-            float component_value = static_cast<float>(extracted_components[j]);
+            float component_value = static_cast<float>(pSrcPixel[j]);
             int color_value = static_cast<int>(
                 (m_pCompData[j].m_DecodeMin +
                  m_pCompData[j].m_DecodeStep * component_value) *
@@ -1401,9 +1398,10 @@ void CPDF_DIBSource::DownSampleScanline32Bit(int orig_Bpp,
                 0.5f);
             extracted_components[j] = pdfium::clamp(color_value, 0, 255);
           }
-          m_pColorSpace->TranslateImageLine(color, extracted_components, 1, 0,
-                                            0, bTransMask);
         }
+        const uint8_t* pSrc =
+            m_bDefaultDecode ? pSrcPixel : extracted_components;
+        m_pColorSpace->TranslateImageLine(color, pSrc, 1, 0, 0, bTransMask);
         argb = FXARGB_MAKE(0xFF, color[2], color[1], color[0]);
       } else {
         argb = FXARGB_MAKE(0xFF, pSrcPixel[2], pSrcPixel[1], pSrcPixel[0]);
diff --git a/testing/resources/pixel/bug_718762.in b/testing/resources/pixel/bug_718762.in
new file mode 100644
index 0000000000..3459dc0a1c
--- /dev/null
+++ b/testing/resources/pixel/bug_718762.in
@@ -0,0 +1,67 @@
+{{header}}
+{{object 1 0}} <<
+  /Type /Pages
+  /Count 1
+  /Kids[ 3 0 R ]
+>>
+endobj
+{{object 2 0}} <<
+  /Type /Catalog
+  /Pages 1 0 R
+>>
+endobj
+{{object 3 0}} <<
+  /Type /Page
+  /Parent 1 0 R
+  /Resources 6 0 R
+  /MediaBox[ 0 0 64 64]
+  /Contents[ 5 0 R ]
+>>
+endobj
+{{object 4 0}} <<
+  /Type /XObject
+  /Subtype /Image
+  /Name /I1
+  /Width 5000
+  /Height 5000
+  /BitsPerComponent 8
+  /ColorSpace /DeviceCMYK
+  /Filter [/ASCIIHexDecode /FlateDecode /DCTDecode]
+  /Decode [1.0 0.0 1.0 0.0 1.0 0.0 1.0 0.0]
+  /Length 734
+>>
+stream
+789cedcd3d4ec2001806e00f680529d4165a643671f112c6901095b09838b01983899bd7e02c9ec
+2c143f8b37802af50cba81770799eef9ddebcc9d7bc355f515c2faf96d1e974e2b2bd68be23bfd8
+3edd3fc436f69acf5844afdbdda795b44907699a24e9b0df3f188c86a35136ccb2713e29c679996
+759312bca6955d7f5e8e8783eabe693aaae9a97a806d3dd74972c4e625dc6a68c5519cd6bd4ede3
+f8edb0adabe26f1bcd47e4c922d6b18955c4793cdf9ddedc9e3dfe9d01000000000000000000000
+0000000000000000000000000000000000000000000000000000000000000000000000000000000
+0000000000000000000000000000000000000000000000000000000000000000000000000000000
+0000000000000000000000000000000000000000000000000000000000000000000000000000000
+000000000000000000000000000000000000000000000000000000000000000000000000fc835ef
+3fe03ce2e1eba
+endstream
+endobj
+{{object 5 0}} <<
+/Length 28
+>>
+stream
+q
+64 0 0 64 0 0 cm
+/I1 Do
+Q
+endstream
+endobj
+{{object 6 0}} <<
+  /ProcSet [/PDF /ImageC]
+  /XObject<</I1 4 0 R >>
+>>
+endobj
+{{xref}}
+trailer <<
+  /Size 7
+  /Root 2 0 R
+>>
+{{startxref}}
+%%EOF
diff --git a/testing/resources/pixel/bug_718762_expected.pdf.0.png b/testing/resources/pixel/bug_718762_expected.pdf.0.png
new file mode 100644
index 0000000000..73069f23aa
Binary files /dev/null and b/testing/resources/pixel/bug_718762_expected.pdf.0.png differ
-- 
cgit v1.2.3