commit 7905fe91e3fc8c42161270757dd1fc6845ab9ee9
author Tom Sepez <tsepez@chromium.org> Wed Nov 16 21:00:45 2022 +0000
committer Pdfium LUCI CQ <pdfium-scoped@luci-project-accounts.iam.gserviceaccount.com> Wed Nov 16 21:00:45 2022 +0000
tree 20dcecef7c917fde01fe984a44653c833f16a757
parent 2dcc45a1aabc1875a5cc464bb3785c7e16e048ff

Use spancpy()/spanset() in cfx_bmpdecompressor.cpp

Get better bounds checking.

Change-Id: Ia7bf6eb810e588f3f925d07f69743cbaa39bf209
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/101451
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

core/fxcodec/bmp/cfx_bmpdecompressor.cpp

diff --git a/core/fxcodec/bmp/cfx_bmpdecompressor.cpp b/core/fxcodec/bmp/cfx_bmpdecompressor.cpp
index 4829fac..b7fdc84 100644
--- a/core/fxcodec/bmp/cfx_bmpdecompressor.cpp
+++ b/core/fxcodec/bmp/cfx_bmpdecompressor.cpp
@@ -17,6 +17,7 @@
 #include "core/fxcrt/data_vector.h"
 #include "core/fxcrt/fx_safe_types.h"
 #include "core/fxcrt/fx_system.h"
+#include "core/fxcrt/span_util.h"
 #include "core/fxge/calculate_pitch.h"
 #include "third_party/base/numerics/safe_math.h"
 
@@ -445,9 +446,8 @@
       case 24:
       case 32:
         // TODO(crbug.com/pdfium/1901): Apply bitfields.
-        uint8_t* dest_buf_data = dest_buf.data();
-        std::copy(dest_buf_data, dest_buf_data + src_row_bytes_,
-                  out_row_buffer_.begin());
+        fxcrt::spancpy(pdfium::make_span(out_row_buffer_),
+                       pdfium::make_span(dest_buf).first(src_row_bytes_));
         idx += src_row_bytes_;
         break;
     }
@@ -478,7 +478,7 @@
 
             ReadNextScanline();
             col_num_ = 0;
-            std::fill(out_row_buffer_.begin(), out_row_buffer_.end(), 0);
+            fxcrt::spanset(pdfium::make_span(out_row_buffer_), 0);
             SaveDecodingStatus(DecodeStatus::kData);
             continue;
           }
@@ -499,7 +499,7 @@
               return BmpDecoder::Status::kFail;
 
             while (row_num_ < bmp_row_num__next) {
-              std::fill(out_row_buffer_.begin(), out_row_buffer_.end(), 0);
+              fxcrt::spanset(pdfium::make_span(out_row_buffer_), 0);
               ReadNextScanline();
             }
             break;
@@ -513,12 +513,12 @@
             size_t second_part_size =
                 first_part & 1 ? first_part + 1 : first_part;
             DataVector<uint8_t> second_part(second_part_size);
-            uint8_t* second_part_data = second_part.data();
             if (!ReadAllOrNone(second_part))
               return BmpDecoder::Status::kContinue;
 
-            std::copy(second_part_data, second_part_data + first_part,
-                      out_row_buffer_.begin() + col_num_);
+            fxcrt::spancpy(pdfium::make_span(out_row_buffer_).subspan(col_num_),
+                           pdfium::make_span(second_part).first(first_part));
+
             for (size_t i = col_num_; i < col_num_ + first_part; ++i) {
               if (!ValidateColorIndex(out_row_buffer_[i]))
                 return BmpDecoder::Status::kFail;
@@ -538,8 +538,10 @@
         if (!ReadAllOrNone(pdfium::make_span(&second_part, 1)))
           return BmpDecoder::Status::kContinue;
 
-        std::fill(out_row_buffer_.begin() + col_num_,
-                  out_row_buffer_.begin() + col_num_ + first_part, second_part);
+        fxcrt::spanset(
+            pdfium::make_span(out_row_buffer_).subspan(col_num_, first_part),
+            second_part);
+
         if (!ValidateColorIndex(out_row_buffer_[col_num_]))
           return BmpDecoder::Status::kFail;
         col_num_ += first_part;
@@ -569,7 +571,7 @@
 
             ReadNextScanline();
             col_num_ = 0;
-            std::fill(out_row_buffer_.begin(), out_row_buffer_.end(), 0);
+            fxcrt::spanset(pdfium::make_span(out_row_buffer_), 0);
             SaveDecodingStatus(DecodeStatus::kData);
             continue;
           }
@@ -590,7 +592,7 @@
               return BmpDecoder::Status::kFail;
 
             while (row_num_ < bmp_row_num__next) {
-              std::fill(out_row_buffer_.begin(), out_row_buffer_.end(), 0);
+              fxcrt::spanset(pdfium::make_span(out_row_buffer_), 0);
               ReadNextScanline();
             }
             break;