From b962ecceb7a7d961fdebc1bdf314d450cc6bf204 Mon Sep 17 00:00:00 2001
From: Lei Zhang <thestig@chromium.org>
Date: Fri, 6 Oct 2017 02:18:04 -0700
Subject: Fix a crash in CPDF_ImageRenderer.

BUG=chromium:770884

Change-Id: Ia609db04b0e596649fbda087290b7da040211f14
Reviewed-on: https://pdfium-review.googlesource.com/15790
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
---
 core/fpdfapi/render/cpdf_imagerenderer.cpp | 9 ++++++---
 core/fpdfapi/render/cpdf_imagerenderer.h   | 1 -
 2 files changed, 6 insertions(+), 4 deletions(-)

(limited to 'core')

diff --git a/core/fpdfapi/render/cpdf_imagerenderer.cpp b/core/fpdfapi/render/cpdf_imagerenderer.cpp
index 6efc62c84b..1351597279 100644
--- a/core/fpdfapi/render/cpdf_imagerenderer.cpp
+++ b/core/fpdfapi/render/cpdf_imagerenderer.cpp
@@ -106,9 +106,12 @@ bool CPDF_ImageRenderer::StartRenderDIBSource() {
     m_FillArgb = m_pRenderStatus->GetFillArgb(m_pImageObject.Get());
   } else if (m_pRenderStatus->GetRenderOptions()->ColorModeIs(
                  CPDF_RenderOptions::kGray)) {
-    m_pClone = m_pDIBSource->Clone(nullptr);
-    m_pClone->ConvertColorScale(0xffffff, 0);
-    m_pDIBSource = m_pClone;
+    RetainPtr<CFX_DIBitmap> pClone = m_pDIBSource->Clone(nullptr);
+    if (!pClone)
+      return false;
+
+    pClone->ConvertColorScale(0xffffff, 0);
+    m_pDIBSource = pClone;
   }
   m_Flags = 0;
   if (m_pRenderStatus->GetRenderOptions()->HasFlag(RENDER_FORCE_DOWNSAMPLE))
diff --git a/core/fpdfapi/render/cpdf_imagerenderer.h b/core/fpdfapi/render/cpdf_imagerenderer.h
index ba61ab4493..a5d9ba769b 100644
--- a/core/fpdfapi/render/cpdf_imagerenderer.h
+++ b/core/fpdfapi/render/cpdf_imagerenderer.h
@@ -70,7 +70,6 @@ class CPDF_ImageRenderer {
   CFX_Matrix m_ImageMatrix;
   CPDF_ImageLoader m_Loader;
   RetainPtr<CFX_DIBSource> m_pDIBSource;
-  RetainPtr<CFX_DIBitmap> m_pClone;
   int m_BitmapAlpha;
   bool m_bPatternColor;
   UnownedPtr<CPDF_Pattern> m_pPattern;
-- 
cgit v1.2.3