commit b94a462ff2cb708a2e99f9c994dfef41326ce4e2
author Tom Sepez <tsepez@chromium.org> Thu Feb 24 18:30:34 2022 +0000
committer Pdfium LUCI CQ <pdfium-scoped@luci-project-accounts.iam.gserviceaccount.com> Thu Feb 24 18:30:34 2022 +0000
tree fc1ce6d5463a238a2a2d97579b74715b8d7a0b76
parent bb530e4d71680b0ed21d92165235c89dc7e28ec9

Fix some arithmetic nits in CBC_CommonBitMatrix.

- make m_bits unsigned to avoid bitwise ops on signed values.
- avoid possibility of UB with signed 1 shifted by 31.
- limit total matrix size to avoid overflows.
- avoid OOB writes in Set().

Change-Id: I8b9f518af34e4ac9a1638f54523797014dc0bfe9
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/90993
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

fxbarcode/common/BC_CommonBitMatrix.cpp

diff --git a/fxbarcode/common/BC_CommonBitMatrix.cpp b/fxbarcode/common/BC_CommonBitMatrix.cpp
index 7a91865..6c82a9f 100644
--- a/fxbarcode/common/BC_CommonBitMatrix.cpp
+++ b/fxbarcode/common/BC_CommonBitMatrix.cpp
@@ -23,29 +23,35 @@
 #include "fxbarcode/common/BC_CommonBitMatrix.h"
 
 #include "core/fxcrt/stl_util.h"
-#include "third_party/base/check.h"
+#include "third_party/base/check_op.h"
 
 CBC_CommonBitMatrix::CBC_CommonBitMatrix() = default;
 
 void CBC_CommonBitMatrix::Init(int32_t width, int32_t height) {
+  CHECK_GE(width, 0);
+  CHECK_GE(height, 0);
+
+  static constexpr int32_t kMaxBits = 1024 * 1024 * 1024;  // 1 Gb.
+  CHECK_LT(width, kMaxBits / height);
+
   m_width = width;
   m_height = height;
   m_rowSize = (width + 31) >> 5;
-  m_bits = fxcrt::Vector2D<int32_t>(m_rowSize, m_height);
+  m_bits = fxcrt::Vector2D<uint32_t>(m_rowSize, m_height);
 }
 
 CBC_CommonBitMatrix::~CBC_CommonBitMatrix() = default;
 
 bool CBC_CommonBitMatrix::Get(int32_t x, int32_t y) const {
   int32_t offset = y * m_rowSize + (x >> 5);
-  if (offset >= m_rowSize * m_height || offset < 0)
+  if (offset < 0 || offset >= m_rowSize * m_height)
     return false;
-  return ((((uint32_t)m_bits[offset]) >> (x & 0x1f)) & 1) != 0;
+  return ((m_bits[offset] >> (x & 0x1f)) & 1) != 0;
 }
 
 void CBC_CommonBitMatrix::Set(int32_t x, int32_t y) {
   int32_t offset = y * m_rowSize + (x >> 5);
-  DCHECK(offset >= 0);
-  DCHECK(offset < m_rowSize * m_height);
-  m_bits[offset] |= 1 << (x & 0x1f);
+  if (offset < 0 || offset >= m_rowSize * m_height)
+    return;
+  m_bits[offset] |= 1u << (x & 0x1f);
 }

fxbarcode/common/BC_CommonBitMatrix.h

diff --git a/fxbarcode/common/BC_CommonBitMatrix.h b/fxbarcode/common/BC_CommonBitMatrix.h
index 7182a52..f862550 100644
--- a/fxbarcode/common/BC_CommonBitMatrix.h
+++ b/fxbarcode/common/BC_CommonBitMatrix.h
@@ -27,7 +27,7 @@
   int32_t m_width = 0;
   int32_t m_height = 0;
   int32_t m_rowSize = 0;
-  std::vector<int32_t> m_bits;
+  std::vector<uint32_t> m_bits;
 };
 
 #endif  // FXBARCODE_COMMON_BC_COMMONBITMATRIX_H_