commit 1dd069208c86928f3947b96bbb4daf0086cbbda0
author Lei Zhang <thestig@chromium.org> Mon Oct 19 19:00:18 2020 +0000
committer Chromium commit bot <commit-bot@chromium.org> Mon Oct 19 19:00:18 2020 +0000
tree 89cb648e9206420433a1fc403a657621729384ad
parent 139ff79122efd5aa943debf70be6dc984dc340db

Disallow some CFX_ScanlineCompositor conversions.

Disallow the combination where the destination bitmap format is
`FXDIB_8bppMask` and the reverse byte order bit is set.
CFX_ScanlineCompositor is not designed to handle this case, and will end
up doing the wrong thing. e.g. for a source format of `FXDIB_Cmyk`,
CFX_ScanlineCompositor will end up calling
CompositeRow_Rgb2Rgb_Blend_NoClip_RgbByteOrder(), which is completely
nonsensical.

Bug: chromium:1037839
Change-Id: Iad9979f770239f4b338d5fa1bfe301ff62d6b6b9
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/75272
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

core/fxge/dib/cfx_scanlinecompositor.cpp

diff --git a/core/fxge/dib/cfx_scanlinecompositor.cpp b/core/fxge/dib/cfx_scanlinecompositor.cpp
index 501e50d..90a47d1 100644
--- a/core/fxge/dib/cfx_scanlinecompositor.cpp
+++ b/core/fxge/dib/cfx_scanlinecompositor.cpp
@@ -2738,6 +2738,10 @@
   m_bRgbByteOrder = bRgbByteOrder;
   if (GetBppFromFormat(dest_format) == 1)
     return false;
+
+  if (m_bRgbByteOrder && m_DestFormat == FXDIB_8bppMask)
+    return false;
+
   if (m_SrcFormat == FXDIB_1bppMask || m_SrcFormat == FXDIB_8bppMask) {
     InitSourceMask(mask_color);
     return true;