commit c85f8943e9cccbfbd7ee0661c112ee9b5ba94d1b
author Lei Zhang <thestig@chromium.org> Fri May 27 23:00:05 2022 +0000
committer Pdfium LUCI CQ <pdfium-scoped@luci-project-accounts.iam.gserviceaccount.com> Fri May 27 23:00:05 2022 +0000
tree ba46e56c7adf5ed8dddd1be59a157fd72c5b6cd8
parent eace5504dfe2716bb7eff591f716478aea2c8ce0

Fix a regression in CJBig2_SDDProc::DecodeArith().

In https://pdfium-review.googlesource.com/92890, the refactoring
accidentally changed a uint32_t variable into a uint8_t variable. As a
result, some calculations in CJBig2_SDDProc are incorrect and some
JPEG2000 images fail to render.

Note that there is no test case here, because the PDF that demonstrates
the bug contains PII, and it is not immediately obvious how to create a
JPEG2000 image with the same properties.

Bug: chromium:1329994
Change-Id: I931045d8fb3ad7c565a1d783143dec5f2121c0ae
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/93970
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Nigi <nigi@chromium.org>

core/fxcodec/jbig2/JBig2_SddProc.cpp

diff --git a/core/fxcodec/jbig2/JBig2_SddProc.cpp b/core/fxcodec/jbig2/JBig2_SddProc.cpp
index a37e5af..f26850b 100644
--- a/core/fxcodec/jbig2/JBig2_SddProc.cpp
+++ b/core/fxcodec/jbig2/JBig2_SddProc.cpp
@@ -163,7 +163,7 @@
           if (!BS)
             return nullptr;
         } else if (REFAGGNINST == 1) {
-          uint8_t SBNUMSYMS = SDNUMINSYMS + NSYMSDECODED;
+          uint32_t SBNUMSYMS = SDNUMINSYMS + NSYMSDECODED;
           uint32_t IDI;
           IAID->Decode(pArithDecoder, &IDI);
           if (IDI >= SBNUMSYMS)