From ac8357b3ec7e1fe4000ebcae5ce65a38bfeb5cb1 Mon Sep 17 00:00:00 2001
From: Nicolas Pena <npm@chromium.org>
Date: Mon, 28 May 2018 20:06:19 +0000
Subject: Revert 'Remove almost all usages of CFX_FixedBufGrow with
 std::vector'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is a manual revert of the CL at:
https://pdfium-review.googlesource.com/c/pdfium/+/32159

The only file manually changed was cpdf_renderstatus.cpp

Reason for revert: the bug below shows that sometimes the vector size
used is larger than the parameter given to CFX_FixedBufGrow. Thus, we
will revert, then add vectors using std::max unless it's clear from the
code that the code will never access indices outside.

Bug: chromium:847247
Change-Id: Iee54af023c8564824418a7d34a6385b0bc418ff0
Reviewed-on: https://pdfium-review.googlesource.com/33050
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Nicolás Peña Moreno <npm@chromium.org>
---
 core/fpdfapi/page/cpdf_colorspace.cpp | 47 ++++++++++++++++++++++-------------
 1 file changed, 30 insertions(+), 17 deletions(-)

(limited to 'core/fpdfapi/page')

diff --git a/core/fpdfapi/page/cpdf_colorspace.cpp b/core/fpdfapi/page/cpdf_colorspace.cpp
index 354a342d90..31c485fe03 100644
--- a/core/fpdfapi/page/cpdf_colorspace.cpp
+++ b/core/fpdfapi/page/cpdf_colorspace.cpp
@@ -31,6 +31,7 @@
 #include "core/fpdfdoc/cpdf_action.h"
 #include "core/fxcodec/codec/ccodec_iccmodule.h"
 #include "core/fxcodec/fx_codec.h"
+#include "core/fxcrt/cfx_fixedbufgrow.h"
 #include "core/fxcrt/fx_memory.h"
 #include "core/fxcrt/maybe_owned.h"
 #include "third_party/base/stl_util.h"
@@ -573,7 +574,8 @@ void CPDF_ColorSpace::TranslateImageLine(uint8_t* dest_buf,
                                          int image_width,
                                          int image_height,
                                          bool bTransMask) const {
-  std::vector<float> src(m_nComponents);
+  CFX_FixedBufGrow<float, 16> srcbuf(m_nComponents);
+  float* src = srcbuf;
   float R;
   float G;
   float B;
@@ -581,7 +583,7 @@ void CPDF_ColorSpace::TranslateImageLine(uint8_t* dest_buf,
   for (int i = 0; i < pixels; i++) {
     for (uint32_t j = 0; j < m_nComponents; j++)
       src[j] = static_cast<float>(*src_buf++) / divisor;
-    GetRGB(src.data(), &R, &G, &B);
+    GetRGB(src, &R, &G, &B);
     *dest_buf++ = static_cast<int32_t>(B * 255);
     *dest_buf++ = static_cast<int32_t>(G * 255);
     *dest_buf++ = static_cast<int32_t>(R * 255);
@@ -1151,15 +1153,15 @@ bool CPDF_IndexedCS::GetRGB(const float* pBuf,
       return false;
     }
   }
-  std::vector<float> comps;
-  comps.reserve(m_nBaseComponents);
+  CFX_FixedBufGrow<float, 16> Comps(m_nBaseComponents);
+  float* comps = Comps;
   const uint8_t* pTable = m_Table.raw_str();
   for (uint32_t i = 0; i < m_nBaseComponents; i++) {
-    comps.push_back(m_pCompMinMax[i * 2] +
-                    m_pCompMinMax[i * 2 + 1] *
-                        pTable[index * m_nBaseComponents + i] / 255);
+    comps[i] =
+        m_pCompMinMax[i * 2] +
+        m_pCompMinMax[i * 2 + 1] * pTable[index * m_nBaseComponents + i] / 255;
   }
-  return m_pBaseCS->GetRGB(comps.data(), R, G, B);
+  return m_pBaseCS->GetRGB(comps, R, G, B);
 }
 
 void CPDF_IndexedCS::EnableStdConversion(bool bEnabled) {
@@ -1216,21 +1218,32 @@ bool CPDF_SeparationCS::GetRGB(const float* pBuf,
                                float* R,
                                float* G,
                                float* B) const {
-  if (m_Type == None || !m_pAltCS)
+  if (m_Type == None)
     return false;
 
   if (!m_pFunc) {
+    if (!m_pAltCS)
+      return false;
+
     int nComps = m_pAltCS->CountComponents();
-    std::vector<float> results(nComps, *pBuf);
-    return m_pAltCS->GetRGB(results.data(), R, G, B);
+    CFX_FixedBufGrow<float, 16> results(nComps);
+    for (int i = 0; i < nComps; i++)
+      results[i] = *pBuf;
+    return m_pAltCS->GetRGB(results, R, G, B);
   }
 
-  std::vector<float> results2(m_pFunc->CountOutputs());
+  CFX_FixedBufGrow<float, 16> results(m_pFunc->CountOutputs());
   int nresults = 0;
-  if (!m_pFunc->Call(pBuf, 1, results2.data(), &nresults) || nresults == 0)
+  if (!m_pFunc->Call(pBuf, 1, results, &nresults) || nresults == 0)
     return false;
 
-  return m_pAltCS->GetRGB(results2.data(), R, G, B);
+  if (m_pAltCS)
+    return m_pAltCS->GetRGB(results, R, G, B);
+
+  R = 0;
+  G = 0;
+  B = 0;
+  return false;
 }
 
 void CPDF_SeparationCS::EnableStdConversion(bool bEnabled) {
@@ -1285,14 +1298,14 @@ bool CPDF_DeviceNCS::GetRGB(const float* pBuf,
   if (!m_pFunc)
     return false;
 
-  std::vector<float> results(m_pFunc->CountOutputs());
+  CFX_FixedBufGrow<float, 16> results(m_pFunc->CountOutputs());
   int nresults = 0;
-  if (!m_pFunc->Call(pBuf, CountComponents(), results.data(), &nresults) ||
+  if (!m_pFunc->Call(pBuf, CountComponents(), results, &nresults) ||
       nresults == 0) {
     return false;
   }
 
-  return m_pAltCS->GetRGB(results.data(), R, G, B);
+  return m_pAltCS->GetRGB(results, R, G, B);
 }
 
 void CPDF_DeviceNCS::EnableStdConversion(bool bEnabled) {
-- 
cgit v1.2.3