Update pitch following conversion in CPDF_DIB::GetScanline().
The fuzzer has found a place where we convert a (4bpp x 4comp) scanline
into a (8bpp x 3comp) scanline, but leave the pitch unchanged (2 bytes
per pixel) instead of updating (3 bytes per pixel). Returning a span
based on the smaller size will cause a check.
Bug: chromium:1255011
Test: clusterfuzz to verify.
Change-Id: I2e721b35a11a40a705e2ff9baef956b3ecee6420
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/85590
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
diff --git a/core/fpdfapi/page/cpdf_dib.cpp b/core/fpdfapi/page/cpdf_dib.cpp
index ae36c08..e58ed3c 100644
--- a/core/fpdfapi/page/cpdf_dib.cpp
+++ b/core/fpdfapi/page/cpdf_dib.cpp
@@ -1175,6 +1175,7 @@
if (m_pColorSpace) {
TranslateScanline24bpp(m_LineBuf.data(), pSrcLine);
pSrcLine = m_LineBuf.data();
+ src_pitch_value = 3 * m_Width;
}
if (!m_bColorKey)
return {pSrcLine, src_pitch_value};
