From 254360730190cc6d6e3de325ee101948b78c1e32 Mon Sep 17 00:00:00 2001 From: Lei Zhang Date: Fri, 13 Feb 2015 12:02:38 -0800 Subject: Fix JPX image rendering that regressed due to several security fixes. BUG=453723 R=tsepez@chromium.org Review URL: https://codereview.chromium.org/892553002 --- core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp | 13 ++++++------- core/src/fpdfapi/fpdf_render/render_int.h | 1 + 2 files changed, 7 insertions(+), 7 deletions(-) (limited to 'core') diff --git a/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp b/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp index a805ffa463..79d73518a1 100644 --- a/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp +++ b/core/src/fpdfapi/fpdf_render/fpdf_render_loadimage.cpp @@ -119,6 +119,7 @@ CPDF_DIBSource::CPDF_DIBSource() m_pColorSpace = NULL; m_bDefaultDecode = TRUE; m_bImageMask = FALSE; + m_bDoBpcCheck = TRUE; m_pPalette = NULL; m_pCompData = NULL; m_bColorKey = FALSE; @@ -197,7 +198,7 @@ FX_BOOL CPDF_DIBSource::Load(CPDF_Document* pDoc, const CPDF_Stream* pStream, CP if (!LoadColorInfo(m_pStream->GetObjNum() != 0 ? NULL : pFormResources, pPageResources)) { return FALSE; } - if (m_bpc == 0 || m_nComponents == 0) { + if (m_bDoBpcCheck && (m_bpc == 0 || m_nComponents == 0)) { return FALSE; } FX_SAFE_DWORD src_pitch = @@ -210,10 +211,6 @@ FX_BOOL CPDF_DIBSource::Load(CPDF_Document* pDoc, const CPDF_Stream* pStream, CP if (m_pStreamAcc->GetSize() == 0 || m_pStreamAcc->GetData() == NULL) { return FALSE; } - const CFX_ByteString& decoder = m_pStreamAcc->GetImageDecoder(); - if (!decoder.IsEmpty() && decoder == FX_BSTRC("CCITTFaxDecode")) { - m_bpc = 1; - } if (!CreateDecoder()) { return FALSE; } @@ -316,7 +313,7 @@ int CPDF_DIBSource::StartLoadDIBSource(CPDF_Document* pDoc, const CPDF_Stream* p if (!LoadColorInfo(m_pStream->GetObjNum() != 0 ? NULL : pFormResources, pPageResources)) { return 0; } - if (m_bpc == 0 || m_nComponents == 0) { + if (m_bDoBpcCheck && (m_bpc == 0 || m_nComponents == 0)) { return 0; } FX_SAFE_DWORD src_pitch = @@ -446,11 +443,13 @@ FX_BOOL CPDF_DIBSource::LoadColorInfo(CPDF_Dictionary* pFormResources, CPDF_Dict if (pFilter->GetType() == PDFOBJ_NAME) { filter = pFilter->GetString(); if (filter == FX_BSTRC("JPXDecode")) { + m_bDoBpcCheck = FALSE; return TRUE; } } else if (pFilter->GetType() == PDFOBJ_ARRAY) { CPDF_Array* pArray = (CPDF_Array*)pFilter; if (pArray->GetString(pArray->GetCount() - 1) == FX_BSTRC("JPXDecode")) { + m_bDoBpcCheck = FALSE; return TRUE; } } @@ -560,7 +559,7 @@ int CPDF_DIBSource::CreateDecoder() if (decoder.IsEmpty()) { return 1; } - if (m_bpc == 0) { + if (m_bDoBpcCheck && m_bpc == 0) { return 0; } FX_LPCBYTE src_data = m_pStreamAcc->GetData(); diff --git a/core/src/fpdfapi/fpdf_render/render_int.h b/core/src/fpdfapi/fpdf_render/render_int.h index 70c41ca93c..5606562bf3 100644 --- a/core/src/fpdfapi/fpdf_render/render_int.h +++ b/core/src/fpdfapi/fpdf_render/render_int.h @@ -436,6 +436,7 @@ protected: FX_BOOL m_bLoadMask; FX_BOOL m_bDefaultDecode; FX_BOOL m_bImageMask; + FX_BOOL m_bDoBpcCheck; FX_BOOL m_bColorKey; DIB_COMP_DATA* m_pCompData; FX_LPBYTE m_pLineBuf; -- cgit v1.2.3