Fix or mark some unsafe code in fxcoded/jbig2 Bug: 42271175 Change-Id: If36f9fe6bbfc664abeb5f006704c5e0b877f4cb0 Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/119756 Reviewed-by: Thomas Sepez <tsepez@google.com> Commit-Queue: Tom Sepez <tsepez@chromium.org> Reviewed-by: Lei Zhang <thestig@chromium.org>
diff --git a/core/fxcodec/jbig2/JBig2_ArithDecoder.cpp b/core/fxcodec/jbig2/JBig2_ArithDecoder.cpp index 0d37ae4..0d73df8 100644 --- a/core/fxcodec/jbig2/JBig2_ArithDecoder.cpp +++ b/core/fxcodec/jbig2/JBig2_ArithDecoder.cpp
@@ -4,38 +4,35 @@ // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com -#if defined(UNSAFE_BUFFERS_BUILD) -// TODO(crbug.com/pdfium/2154): resolve buffer safety issues. -#pragma allow_unsafe_buffers -#endif - #include "core/fxcodec/jbig2/JBig2_ArithDecoder.h" +#include <array> #include <iterator> #include "core/fxcodec/jbig2/JBig2_BitStream.h" #include "core/fxcrt/check_op.h" +#include "core/fxcrt/stl_util.h" namespace { -const JBig2ArithCtx::JBig2ArithQe kQeTable[] = { - // Stupid hack to keep clang-format from reformatting this badly. - {0x5601, 1, 1, true}, {0x3401, 2, 6, false}, {0x1801, 3, 9, false}, - {0x0AC1, 4, 12, false}, {0x0521, 5, 29, false}, {0x0221, 38, 33, false}, - {0x5601, 7, 6, true}, {0x5401, 8, 14, false}, {0x4801, 9, 14, false}, - {0x3801, 10, 14, false}, {0x3001, 11, 17, false}, {0x2401, 12, 18, false}, - {0x1C01, 13, 20, false}, {0x1601, 29, 21, false}, {0x5601, 15, 14, true}, - {0x5401, 16, 14, false}, {0x5101, 17, 15, false}, {0x4801, 18, 16, false}, - {0x3801, 19, 17, false}, {0x3401, 20, 18, false}, {0x3001, 21, 19, false}, - {0x2801, 22, 19, false}, {0x2401, 23, 20, false}, {0x2201, 24, 21, false}, - {0x1C01, 25, 22, false}, {0x1801, 26, 23, false}, {0x1601, 27, 24, false}, - {0x1401, 28, 25, false}, {0x1201, 29, 26, false}, {0x1101, 30, 27, false}, - {0x0AC1, 31, 28, false}, {0x09C1, 32, 29, false}, {0x08A1, 33, 30, false}, - {0x0521, 34, 31, false}, {0x0441, 35, 32, false}, {0x02A1, 36, 33, false}, - {0x0221, 37, 34, false}, {0x0141, 38, 35, false}, {0x0111, 39, 36, false}, - {0x0085, 40, 37, false}, {0x0049, 41, 38, false}, {0x0025, 42, 39, false}, - {0x0015, 43, 40, false}, {0x0009, 44, 41, false}, {0x0005, 45, 42, false}, - {0x0001, 45, 43, false}, {0x5601, 46, 46, false}}; +constexpr auto kQeTable = fxcrt::ToArray<const JBig2ArithCtx::JBig2ArithQe>( + {// Stupid hack to keep clang-format from reformatting this badly. + {0x5601, 1, 1, true}, {0x3401, 2, 6, false}, {0x1801, 3, 9, false}, + {0x0AC1, 4, 12, false}, {0x0521, 5, 29, false}, {0x0221, 38, 33, false}, + {0x5601, 7, 6, true}, {0x5401, 8, 14, false}, {0x4801, 9, 14, false}, + {0x3801, 10, 14, false}, {0x3001, 11, 17, false}, {0x2401, 12, 18, false}, + {0x1C01, 13, 20, false}, {0x1601, 29, 21, false}, {0x5601, 15, 14, true}, + {0x5401, 16, 14, false}, {0x5101, 17, 15, false}, {0x4801, 18, 16, false}, + {0x3801, 19, 17, false}, {0x3401, 20, 18, false}, {0x3001, 21, 19, false}, + {0x2801, 22, 19, false}, {0x2401, 23, 20, false}, {0x2201, 24, 21, false}, + {0x1C01, 25, 22, false}, {0x1801, 26, 23, false}, {0x1601, 27, 24, false}, + {0x1401, 28, 25, false}, {0x1201, 29, 26, false}, {0x1101, 30, 27, false}, + {0x0AC1, 31, 28, false}, {0x09C1, 32, 29, false}, {0x08A1, 33, 30, false}, + {0x0521, 34, 31, false}, {0x0441, 35, 32, false}, {0x02A1, 36, 33, false}, + {0x0221, 37, 34, false}, {0x0141, 38, 35, false}, {0x0111, 39, 36, false}, + {0x0085, 40, 37, false}, {0x0049, 41, 38, false}, {0x0025, 42, 39, false}, + {0x0015, 43, 40, false}, {0x0009, 44, 41, false}, {0x0005, 45, 42, false}, + {0x0001, 45, 43, false}, {0x5601, 46, 46, false}}); const unsigned int kDefaultAValue = 0x8000;
diff --git a/core/fxcodec/jbig2/JBig2_ArithIntDecoder.cpp b/core/fxcodec/jbig2/JBig2_ArithIntDecoder.cpp index 16e9946..0a05d99 100644 --- a/core/fxcodec/jbig2/JBig2_ArithIntDecoder.cpp +++ b/core/fxcodec/jbig2/JBig2_ArithIntDecoder.cpp
@@ -4,16 +4,13 @@ // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com -#if defined(UNSAFE_BUFFERS_BUILD) -// TODO(crbug.com/pdfium/2154): resolve buffer safety issues. -#pragma allow_unsafe_buffers -#endif - #include "core/fxcodec/jbig2/JBig2_ArithIntDecoder.h" +#include <array> #include <vector> #include "core/fxcrt/fx_safe_types.h" +#include "core/fxcrt/stl_util.h" namespace { @@ -26,9 +23,14 @@ int nValue; }; -constexpr ArithIntDecodeData kArithIntDecodeData[] = { - {2, 0}, {4, 4}, {6, 20}, {8, 84}, {12, 340}, {32, 4436}, -}; +constexpr auto kArithIntDecodeData = fxcrt::ToArray<ArithIntDecodeData>({ + {2, 0}, + {4, 4}, + {6, 20}, + {8, 84}, + {12, 340}, + {32, 4436}, +}); size_t RecursiveDecode(CJBig2_ArithDecoder* decoder, std::vector<JBig2ArithCtx>* context,
diff --git a/core/fxcodec/jbig2/JBig2_Context.cpp b/core/fxcodec/jbig2/JBig2_Context.cpp index a42b8f2..5e41162 100644 --- a/core/fxcodec/jbig2/JBig2_Context.cpp +++ b/core/fxcodec/jbig2/JBig2_Context.cpp
@@ -4,11 +4,6 @@ // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com -#if defined(UNSAFE_BUFFERS_BUILD) -// TODO(crbug.com/pdfium/2154): resolve buffer safety issues. -#pragma allow_unsafe_buffers -#endif - #include "core/fxcodec/jbig2/JBig2_Context.h" #include <algorithm> @@ -437,7 +432,7 @@ const CJBig2_SymbolDict& dict = *pSeg->m_SymbolDict; for (uint32_t j = 0; j < dict.NumImages(); ++j) { uint32_t dwTemp = (dwNumSyms + j).ValueOrDie(); - SDINSYMS.get()[dwTemp] = dict.GetImage(j); + UNSAFE_TODO(SDINSYMS.get()[dwTemp] = dict.GetImage(j)); } dwNumSyms += dict.NumImages(); } @@ -652,7 +647,7 @@ const CJBig2_SymbolDict& dict = *pSeg->m_SymbolDict; for (uint32_t j = 0; j < dict.NumImages(); ++j) { uint32_t dwIndex = (dwNumSyms + j).ValueOrDie(); - SBSYMS.get()[dwIndex] = dict.GetImage(j); + UNSAFE_TODO(SBSYMS.get()[dwIndex] = dict.GetImage(j)); } dwNumSyms += dict.NumImages(); } @@ -1125,13 +1120,14 @@ std::vector<JBig2HuffmanCode> CJBig2_Context::DecodeSymbolIDHuffmanTable( uint32_t SBNUMSYMS) { const size_t kRunCodesSize = 35; - JBig2HuffmanCode huffman_codes[kRunCodesSize]; + std::array<JBig2HuffmanCode, kRunCodesSize> huffman_codes; for (size_t i = 0; i < kRunCodesSize; ++i) { if (m_pStream->readNBits(4, &huffman_codes[i].codelen) != 0) return std::vector<JBig2HuffmanCode>(); } - if (!HuffmanAssignCode(huffman_codes, kRunCodesSize)) + if (!HuffmanAssignCode(huffman_codes.data(), kRunCodesSize)) { return std::vector<JBig2HuffmanCode>(); + } std::vector<JBig2HuffmanCode> SBSYMCODES(SBNUMSYMS); int32_t run = 0; @@ -1207,13 +1203,14 @@ bool CJBig2_Context::HuffmanAssignCode(JBig2HuffmanCode* SBSYMCODES, uint32_t NTEMP) { int LENMAX = 0; - for (uint32_t i = 0; i < NTEMP; ++i) - LENMAX = std::max(SBSYMCODES[i].codelen, LENMAX); - + for (uint32_t i = 0; i < NTEMP; ++i) { + LENMAX = std::max(UNSAFE_TODO(SBSYMCODES[i].codelen), LENMAX); + } std::vector<int> LENCOUNT(LENMAX + 1); std::vector<int> FIRSTCODE(LENMAX + 1); - for (uint32_t i = 0; i < NTEMP; ++i) - ++LENCOUNT[SBSYMCODES[i].codelen]; + for (uint32_t i = 0; i < NTEMP; ++i) { + UNSAFE_TODO(++LENCOUNT[SBSYMCODES[i].codelen]); + } LENCOUNT[0] = 0; for (int i = 1; i <= LENMAX; ++i) { @@ -1225,10 +1222,13 @@ FIRSTCODE[i] = shifted.ValueOrDie(); int CURCODE = FIRSTCODE[i]; - for (uint32_t j = 0; j < NTEMP; ++j) { - if (SBSYMCODES[j].codelen == i) - SBSYMCODES[j].code = CURCODE++; - } + UNSAFE_TODO({ + for (uint32_t j = 0; j < NTEMP; ++j) { + if (SBSYMCODES[j].codelen == i) { + SBSYMCODES[j].code = CURCODE++; + } + } + }); } return true; }
diff --git a/core/fxcodec/jbig2/JBig2_GrdProc.h b/core/fxcodec/jbig2/JBig2_GrdProc.h index c543ea1..c384064 100644 --- a/core/fxcodec/jbig2/JBig2_GrdProc.h +++ b/core/fxcodec/jbig2/JBig2_GrdProc.h
@@ -9,6 +9,7 @@ #include <stdint.h> +#include <array> #include <memory> #include "core/fxcodec/fx_codec_def.h" @@ -54,7 +55,7 @@ uint32_t GBW; uint32_t GBH; UnownedPtr<CJBig2_Image> SKIP; - int8_t GBAT[8]; + std::array<int8_t, 8> GBAT; private: bool UseTemplate0Opt3() const;
diff --git a/core/fxcodec/jbig2/JBig2_GrrdProc.cpp b/core/fxcodec/jbig2/JBig2_GrrdProc.cpp index bf1d0f1..20be592 100644 --- a/core/fxcodec/jbig2/JBig2_GrrdProc.cpp +++ b/core/fxcodec/jbig2/JBig2_GrrdProc.cpp
@@ -4,11 +4,6 @@ // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com -#if defined(UNSAFE_BUFFERS_BUILD) -// TODO(crbug.com/pdfium/2154): resolve buffer safety issues. -#pragma allow_unsafe_buffers -#endif - #include "core/fxcodec/jbig2/JBig2_GrrdProc.h" #include <memory> @@ -16,6 +11,7 @@ #include "core/fxcodec/jbig2/JBig2_ArithDecoder.h" #include "core/fxcodec/jbig2/JBig2_BitStream.h" #include "core/fxcodec/jbig2/JBig2_Image.h" +#include "core/fxcrt/compiler_specific.h" CJBig2_GRRDProc::CJBig2_GRRDProc() = default; @@ -56,7 +52,7 @@ if (pArithDecoder->IsComplete()) return nullptr; - LTP = LTP ^ pArithDecoder->Decode(&grContext[0x0010]); + LTP = LTP ^ pArithDecoder->Decode(UNSAFE_TODO(&grContext[0x0010])); } uint32_t lines[5]; lines[0] = GRREG->GetPixel(1, h - 1); @@ -81,7 +77,7 @@ if (pArithDecoder->IsComplete()) return nullptr; - int bVal = pArithDecoder->Decode(&grContext[CONTEXT]); + int bVal = pArithDecoder->Decode(UNSAFE_TODO(&grContext[CONTEXT])); DecodeTemplate0UnoptSetPixel(GRREG.get(), lines, w, h, bVal); } } else { @@ -100,7 +96,7 @@ if (pArithDecoder->IsComplete()) return nullptr; - bVal = pArithDecoder->Decode(&grContext[CONTEXT]); + bVal = pArithDecoder->Decode(UNSAFE_TODO(&grContext[CONTEXT])); } DecodeTemplate0UnoptSetPixel(GRREG.get(), lines, w, h, bVal); } @@ -114,16 +110,18 @@ const uint32_t* lines, uint32_t w, uint32_t h) const { - uint32_t CONTEXT = lines[4]; - CONTEXT |= lines[3] << 3; - CONTEXT |= lines[2] << 6; - CONTEXT |= GRREFERENCE->GetPixel(w - GRREFERENCEDX + GRAT[2], - h - GRREFERENCEDY + GRAT[3]) - << 8; - CONTEXT |= lines[1] << 9; - CONTEXT |= lines[0] << 10; - CONTEXT |= GRREG.GetPixel(w + GRAT[0], h + GRAT[1]) << 12; - return CONTEXT; + UNSAFE_TODO({ + uint32_t CONTEXT = lines[4]; + CONTEXT |= lines[3] << 3; + CONTEXT |= lines[2] << 6; + CONTEXT |= GRREFERENCE->GetPixel(w - GRREFERENCEDX + GRAT[2], + h - GRREFERENCEDY + GRAT[3]) + << 8; + CONTEXT |= lines[1] << 9; + CONTEXT |= lines[0] << 10; + CONTEXT |= GRREG.GetPixel(w + GRAT[0], h + GRAT[1]) << 12; + return CONTEXT; + }); } void CJBig2_GRRDProc::DecodeTemplate0UnoptSetPixel(CJBig2_Image* GRREG, @@ -132,17 +130,21 @@ uint32_t h, int bVal) { GRREG->SetPixel(w, h, bVal); - lines[0] = ((lines[0] << 1) | GRREG->GetPixel(w + 2, h - 1)) & 0x03; - lines[1] = ((lines[1] << 1) | bVal) & 0x01; - lines[2] = ((lines[2] << 1) | GRREFERENCE->GetPixel(w - GRREFERENCEDX + 2, - h - GRREFERENCEDY - 1)) & - 0x03; - lines[3] = ((lines[3] << 1) | - GRREFERENCE->GetPixel(w - GRREFERENCEDX + 2, h - GRREFERENCEDY)) & - 0x07; - lines[4] = ((lines[4] << 1) | GRREFERENCE->GetPixel(w - GRREFERENCEDX + 2, - h - GRREFERENCEDY + 1)) & - 0x07; + UNSAFE_TODO({ + lines[0] = ((lines[0] << 1) | GRREG->GetPixel(w + 2, h - 1)) & 0x03; + lines[1] = ((lines[1] << 1) | bVal) & 0x01; + lines[2] = + ((lines[2] << 1) | + GRREFERENCE->GetPixel(w - GRREFERENCEDX + 2, h - GRREFERENCEDY - 1)) & + 0x03; + lines[3] = ((lines[3] << 1) | GRREFERENCE->GetPixel(w - GRREFERENCEDX + 2, + h - GRREFERENCEDY)) & + 0x07; + lines[4] = + ((lines[4] << 1) | + GRREFERENCE->GetPixel(w - GRREFERENCEDX + 2, h - GRREFERENCEDY + 1)) & + 0x07; + }); } std::unique_ptr<CJBig2_Image> CJBig2_GRRDProc::DecodeTemplate0Opt( @@ -172,24 +174,26 @@ if (pArithDecoder->IsComplete()) return nullptr; - LTP = LTP ^ pArithDecoder->Decode(&grContext[0x0010]); + LTP = LTP ^ pArithDecoder->Decode(UNSAFE_TODO(&grContext[0x0010])); } - uint32_t line1 = (h > 0) ? pLine[-nStride] << 4 : 0; + uint32_t line1 = (h > 0) ? UNSAFE_TODO(pLine[-nStride]) << 4 : 0; int32_t reference_h = h - GRREFERENCEDY; bool line1_r_ok = (reference_h > 0 && reference_h < GRHR + 1); bool line2_r_ok = (reference_h > -1 && reference_h < GRHR); bool line3_r_ok = (reference_h > -2 && reference_h < GRHR - 1); - uint32_t line1_r = line1_r_ok ? pLineR[nOffset - nStrideR] : 0; - uint32_t line2_r = line2_r_ok ? pLineR[nOffset] : 0; - uint32_t line3_r = line3_r_ok ? pLineR[nOffset + nStrideR] : 0; + uint32_t line1_r = line1_r_ok ? UNSAFE_TODO(pLineR[nOffset - nStrideR]) : 0; + uint32_t line2_r = line2_r_ok ? UNSAFE_TODO(pLineR[nOffset]) : 0; + uint32_t line3_r = line3_r_ok ? UNSAFE_TODO(pLineR[nOffset + nStrideR]) : 0; if (!LTP) { uint32_t CONTEXT = (line1 & 0x1c00) | (line1_r & 0x01c0) | ((line2_r >> 3) & 0x0038) | ((line3_r >> 6) & 0x0007); for (int32_t w = 0; w < iGRW; w += 8) { int32_t nBits = iGRW - w > 8 ? 8 : iGRW - w; if (h > 0) { - line1 = (line1 << 8) | - (w + 8 < iGRW ? pLine[-nStride + (w >> 3) + 1] << 4 : 0); + line1 = + (line1 << 8) | + (w + 8 < iGRW ? UNSAFE_TODO(pLine[-nStride + (w >> 3) + 1]) << 4 + : 0); } if (h > GRHR + GRREFERENCEDY + 1) { line1_r = 0; @@ -199,23 +203,29 @@ if (line1_r_ok) { line1_r = (line1_r << 8) | - (w + 8 < GRWR ? pLineR[nOffset - nStrideR + (w >> 3) + 1] : 0); + (w + 8 < GRWR + ? UNSAFE_TODO(pLineR[nOffset - nStrideR + (w >> 3) + 1]) + : 0); } if (line2_r_ok) { - line2_r = (line2_r << 8) | - (w + 8 < GRWR ? pLineR[nOffset + (w >> 3) + 1] : 0); + line2_r = + (line2_r << 8) | + (w + 8 < GRWR ? UNSAFE_TODO(pLineR[nOffset + (w >> 3) + 1]) + : 0); } if (line3_r_ok) { line3_r = (line3_r << 8) | - (w + 8 < GRWR ? pLineR[nOffset + nStrideR + (w >> 3) + 1] : 0); + (w + 8 < GRWR + ? UNSAFE_TODO(pLineR[nOffset + nStrideR + (w >> 3) + 1]) + : 0); } else { line3_r = 0; } } uint8_t cVal = 0; for (int32_t k = 0; k < nBits; k++) { - int bVal = pArithDecoder->Decode(&grContext[CONTEXT]); + int bVal = pArithDecoder->Decode(UNSAFE_TODO(&grContext[CONTEXT])); cVal |= bVal << (7 - k); CONTEXT = ((CONTEXT & 0x0cdb) << 1) | (bVal << 9) | ((line1 >> (7 - k)) & 0x0400) | @@ -223,7 +233,7 @@ ((line2_r >> (10 - k)) & 0x0008) | ((line3_r >> (13 - k)) & 0x0001); } - pLine[w >> 3] = cVal; + UNSAFE_TODO(pLine[w >> 3] = cVal); } } else { uint32_t CONTEXT = (line1 & 0x1c00) | (line1_r & 0x01c0) | @@ -231,22 +241,29 @@ for (int32_t w = 0; w < iGRW; w += 8) { int32_t nBits = iGRW - w > 8 ? 8 : iGRW - w; if (h > 0) { - line1 = (line1 << 8) | - (w + 8 < iGRW ? pLine[-nStride + (w >> 3) + 1] << 4 : 0); + line1 = + (line1 << 8) | + (w + 8 < iGRW ? UNSAFE_TODO(pLine[-nStride + (w >> 3) + 1]) << 4 + : 0); } if (line1_r_ok) { line1_r = (line1_r << 8) | - (w + 8 < GRWR ? pLineR[nOffset - nStrideR + (w >> 3) + 1] : 0); + (w + 8 < GRWR + ? UNSAFE_TODO(pLineR[nOffset - nStrideR + (w >> 3) + 1]) + : 0); } if (line2_r_ok) { - line2_r = (line2_r << 8) | - (w + 8 < GRWR ? pLineR[nOffset + (w >> 3) + 1] : 0); + line2_r = + (line2_r << 8) | + (w + 8 < GRWR ? UNSAFE_TODO(pLineR[nOffset + (w >> 3) + 1]) : 0); } if (line3_r_ok) { line3_r = (line3_r << 8) | - (w + 8 < GRWR ? pLineR[nOffset + nStrideR + (w >> 3) + 1] : 0); + (w + 8 < GRWR + ? UNSAFE_TODO(pLineR[nOffset + nStrideR + (w >> 3) + 1]) + : 0); } else { line3_r = 0; } @@ -264,7 +281,7 @@ if (pArithDecoder->IsComplete()) return nullptr; - bVal = pArithDecoder->Decode(&grContext[CONTEXT]); + bVal = pArithDecoder->Decode(UNSAFE_TODO(&grContext[CONTEXT])); } cVal |= bVal << (7 - k); CONTEXT = ((CONTEXT & 0x0cdb) << 1) | (bVal << 9) | @@ -273,12 +290,13 @@ ((line2_r >> (10 - k)) & 0x0008) | ((line3_r >> (13 - k)) & 0x0001); } - pLine[w >> 3] = cVal; + UNSAFE_TODO(pLine[w >> 3] = cVal); } } - pLine += nStride; - if (h < GRHR + GRREFERENCEDY) - pLineR += nStrideR; + UNSAFE_TODO(pLine += nStride); + if (h < GRHR + GRREFERENCEDY) { + UNSAFE_TODO(pLineR += nStrideR); + } } return GRREG; } @@ -297,7 +315,7 @@ if (pArithDecoder->IsComplete()) return nullptr; - LTP = LTP ^ pArithDecoder->Decode(&grContext[0x0008]); + LTP = LTP ^ pArithDecoder->Decode(UNSAFE_TODO(&grContext[0x0008])); } if (!LTP) { uint32_t line1 = GRREG->GetPixel(1, h - 1); @@ -324,7 +342,7 @@ if (pArithDecoder->IsComplete()) return nullptr; - int bVal = pArithDecoder->Decode(&grContext[CONTEXT]); + int bVal = pArithDecoder->Decode(UNSAFE_TODO(&grContext[CONTEXT])); GRREG->SetPixel(w, h, bVal); line1 = ((line1 << 1) | GRREG->GetPixel(w + 2, h - 1)) & 0x07; line2 = ((line2 << 1) | bVal) & 0x01; @@ -372,7 +390,7 @@ if (pArithDecoder->IsComplete()) return nullptr; - bVal = pArithDecoder->Decode(&grContext[CONTEXT]); + bVal = pArithDecoder->Decode(UNSAFE_TODO(&grContext[CONTEXT])); } GRREG->SetPixel(w, h, bVal); line1 = ((line1 << 1) | GRREG->GetPixel(w + 2, h - 1)) & 0x07; @@ -420,41 +438,48 @@ if (pArithDecoder->IsComplete()) return nullptr; - LTP = LTP ^ pArithDecoder->Decode(&grContext[0x0008]); + LTP = LTP ^ pArithDecoder->Decode(UNSAFE_TODO(&grContext[0x0008])); } - uint32_t line1 = (h > 0) ? pLine[-nStride] << 1 : 0; + uint32_t line1 = (h > 0) ? UNSAFE_TODO(pLine[-nStride]) << 1 : 0; int32_t reference_h = h - GRREFERENCEDY; bool line1_r_ok = (reference_h > 0 && reference_h < GRHR + 1); bool line2_r_ok = (reference_h > -1 && reference_h < GRHR); bool line3_r_ok = (reference_h > -2 && reference_h < GRHR - 1); - uint32_t line1_r = line1_r_ok ? pLineR[nOffset - nStrideR] : 0; - uint32_t line2_r = line2_r_ok ? pLineR[nOffset] : 0; - uint32_t line3_r = line3_r_ok ? pLineR[nOffset + nStrideR] : 0; + uint32_t line1_r = line1_r_ok ? UNSAFE_TODO(pLineR[nOffset - nStrideR]) : 0; + uint32_t line2_r = line2_r_ok ? UNSAFE_TODO(pLineR[nOffset]) : 0; + uint32_t line3_r = line3_r_ok ? UNSAFE_TODO(pLineR[nOffset + nStrideR]) : 0; if (!LTP) { uint32_t CONTEXT = (line1 & 0x0380) | ((line1_r >> 2) & 0x0020) | ((line2_r >> 4) & 0x001c) | ((line3_r >> 6) & 0x0003); for (int32_t w = 0; w < iGRW; w += 8) { int32_t nBits = iGRW - w > 8 ? 8 : iGRW - w; if (h > 0) - line1 = (line1 << 8) | - (w + 8 < iGRW ? pLine[-nStride + (w >> 3) + 1] << 1 : 0); + line1 = + (line1 << 8) | + (w + 8 < iGRW ? UNSAFE_TODO(pLine[-nStride + (w >> 3) + 1]) << 1 + : 0); if (line1_r_ok) line1_r = (line1_r << 8) | - (w + 8 < GRWR ? pLineR[nOffset - nStrideR + (w >> 3) + 1] : 0); + (w + 8 < GRWR + ? UNSAFE_TODO(pLineR[nOffset - nStrideR + (w >> 3) + 1]) + : 0); if (line2_r_ok) - line2_r = (line2_r << 8) | - (w + 8 < GRWR ? pLineR[nOffset + (w >> 3) + 1] : 0); + line2_r = + (line2_r << 8) | + (w + 8 < GRWR ? UNSAFE_TODO(pLineR[nOffset + (w >> 3) + 1]) : 0); if (line3_r_ok) { line3_r = (line3_r << 8) | - (w + 8 < GRWR ? pLineR[nOffset + nStrideR + (w >> 3) + 1] : 0); + (w + 8 < GRWR + ? UNSAFE_TODO(pLineR[nOffset + nStrideR + (w >> 3) + 1]) + : 0); } else { line3_r = 0; } uint8_t cVal = 0; for (int32_t k = 0; k < nBits; k++) { - int bVal = pArithDecoder->Decode(&grContext[CONTEXT]); + int bVal = pArithDecoder->Decode(UNSAFE_TODO(&grContext[CONTEXT])); cVal |= bVal << (7 - k); CONTEXT = ((CONTEXT & 0x018d) << 1) | (bVal << 6) | ((line1 >> (7 - k)) & 0x0080) | @@ -462,7 +487,7 @@ ((line2_r >> (11 - k)) & 0x0004) | ((line3_r >> (13 - k)) & 0x0001); } - pLine[w >> 3] = cVal; + UNSAFE_TODO(pLine[w >> 3] = cVal); } } else { uint32_t CONTEXT = (line1 & 0x0380) | ((line1_r >> 2) & 0x0020) | @@ -470,19 +495,26 @@ for (int32_t w = 0; w < iGRW; w += 8) { int32_t nBits = iGRW - w > 8 ? 8 : iGRW - w; if (h > 0) - line1 = (line1 << 8) | - (w + 8 < iGRW ? pLine[-nStride + (w >> 3) + 1] << 1 : 0); + line1 = + (line1 << 8) | + (w + 8 < iGRW ? UNSAFE_TODO(pLine[-nStride + (w >> 3) + 1]) << 1 + : 0); if (line1_r_ok) line1_r = (line1_r << 8) | - (w + 8 < GRWR ? pLineR[nOffset - nStrideR + (w >> 3) + 1] : 0); + (w + 8 < GRWR + ? UNSAFE_TODO(pLineR[nOffset - nStrideR + (w >> 3) + 1]) + : 0); if (line2_r_ok) - line2_r = (line2_r << 8) | - (w + 8 < GRWR ? pLineR[nOffset + (w >> 3) + 1] : 0); + line2_r = + (line2_r << 8) | + (w + 8 < GRWR ? UNSAFE_TODO(pLineR[nOffset + (w >> 3) + 1]) : 0); if (line3_r_ok) { line3_r = (line3_r << 8) | - (w + 8 < GRWR ? pLineR[nOffset + nStrideR + (w >> 3) + 1] : 0); + (w + 8 < GRWR + ? UNSAFE_TODO(pLineR[nOffset + nStrideR + (w >> 3) + 1]) + : 0); } else { line3_r = 0; } @@ -500,7 +532,7 @@ if (pArithDecoder->IsComplete()) return nullptr; - bVal = pArithDecoder->Decode(&grContext[CONTEXT]); + bVal = pArithDecoder->Decode(UNSAFE_TODO(&grContext[CONTEXT])); } cVal |= bVal << (7 - k); CONTEXT = ((CONTEXT & 0x018d) << 1) | (bVal << 6) | @@ -509,12 +541,13 @@ ((line2_r >> (11 - k)) & 0x0004) | ((line3_r >> (13 - k)) & 0x0001); } - pLine[w >> 3] = cVal; + UNSAFE_TODO(pLine[w >> 3] = cVal); } } - pLine += nStride; - if (h < GRHR + GRREFERENCEDY) - pLineR += nStrideR; + UNSAFE_TODO(pLine += nStride); + if (h < GRHR + GRREFERENCEDY) { + UNSAFE_TODO(pLineR += nStrideR); + } } return GRREG; }
diff --git a/core/fxcodec/jbig2/JBig2_GrrdProc.h b/core/fxcodec/jbig2/JBig2_GrrdProc.h index d1a729b..39cf153 100644 --- a/core/fxcodec/jbig2/JBig2_GrrdProc.h +++ b/core/fxcodec/jbig2/JBig2_GrrdProc.h
@@ -9,6 +9,7 @@ #include <stdint.h> +#include <array> #include <memory> #include "core/fxcrt/unowned_ptr.h" @@ -32,7 +33,7 @@ int32_t GRREFERENCEDX; int32_t GRREFERENCEDY; UnownedPtr<CJBig2_Image> GRREFERENCE; - int8_t GRAT[4]; + std::array<int8_t, 4> GRAT; private: std::unique_ptr<CJBig2_Image> DecodeTemplate0Unopt(
diff --git a/core/fxcodec/jbig2/JBig2_HtrdProc.cpp b/core/fxcodec/jbig2/JBig2_HtrdProc.cpp index d8de754..16a87cc 100644 --- a/core/fxcodec/jbig2/JBig2_HtrdProc.cpp +++ b/core/fxcodec/jbig2/JBig2_HtrdProc.cpp
@@ -4,11 +4,6 @@ // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com -#if defined(UNSAFE_BUFFERS_BUILD) -// TODO(crbug.com/pdfium/2154): resolve buffer safety issues. -#pragma allow_unsafe_buffers -#endif - #include "core/fxcodec/jbig2/JBig2_HtrdProc.h" #include <algorithm>
diff --git a/core/fxcodec/jbig2/JBig2_HuffmanTable.cpp b/core/fxcodec/jbig2/JBig2_HuffmanTable.cpp index 9bed27c..bccf238 100644 --- a/core/fxcodec/jbig2/JBig2_HuffmanTable.cpp +++ b/core/fxcodec/jbig2/JBig2_HuffmanTable.cpp
@@ -4,11 +4,6 @@ // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com -#if defined(UNSAFE_BUFFERS_BUILD) -// TODO(crbug.com/pdfium/2154): resolve buffer safety issues. -#pragma allow_unsafe_buffers -#endif - #include "core/fxcodec/jbig2/JBig2_HuffmanTable.h" #include <iterator> @@ -17,6 +12,7 @@ #include "core/fxcodec/jbig2/JBig2_BitStream.h" #include "core/fxcodec/jbig2/JBig2_Context.h" #include "core/fxcrt/check.h" +#include "core/fxcrt/compiler_specific.h" #include "core/fxcrt/fx_safe_types.h" #include "core/fxcrt/unowned_ptr_exclusion.h" @@ -111,7 +107,7 @@ {1, 0, 0}, {3, 0, 1}, {4, 0, 2}, {5, 1, 3}, {6, 2, 5}, {7, 4, 9}, {7, 32, -25}, {7, 32, 25}}; -constexpr HuffmanTable kHuffmanTables[16] = { +constexpr std::array<const HuffmanTable, 16> kHuffmanTables = {{ {false, nullptr, 0}, // Zero dummy to preserve indexing. {false, kTableLine1, std::size(kTableLine1)}, {true, kTableLine2, std::size(kTableLine2)}, @@ -127,7 +123,8 @@ {false, kTableLine12, std::size(kTableLine12)}, {false, kTableLine13, std::size(kTableLine13)}, {false, kTableLine14, std::size(kTableLine14)}, - {false, kTableLine15, std::size(kTableLine15)}}; + {false, kTableLine15, std::size(kTableLine15)}, +}}; static_assert(CJBig2_HuffmanTable::kNumHuffmanTables == std::size(kHuffmanTables), @@ -157,11 +154,13 @@ CODES.resize(NTEMP); RANGELEN.resize(NTEMP); RANGELOW.resize(NTEMP); - for (uint32_t i = 0; i < NTEMP; ++i) { - CODES[i].codelen = pTable[i].PREFLEN; - RANGELEN[i] = pTable[i].RANDELEN; - RANGELOW[i] = pTable[i].RANGELOW; - } + UNSAFE_TODO({ + for (uint32_t i = 0; i < NTEMP; ++i) { + CODES[i].codelen = pTable[i].PREFLEN; + RANGELEN[i] = pTable[i].RANDELEN; + RANGELOW[i] = pTable[i].RANGELOW; + } + }); return CJBig2_Context::HuffmanAssignCode(CODES.data(), NTEMP); }
diff --git a/core/fxcodec/jbig2/JBig2_PddProc.cpp b/core/fxcodec/jbig2/JBig2_PddProc.cpp index 57b4158..c91f591 100644 --- a/core/fxcodec/jbig2/JBig2_PddProc.cpp +++ b/core/fxcodec/jbig2/JBig2_PddProc.cpp
@@ -4,11 +4,6 @@ // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com -#if defined(UNSAFE_BUFFERS_BUILD) -// TODO(crbug.com/pdfium/2154): resolve buffer safety issues. -#pragma allow_unsafe_buffers -#endif - #include "core/fxcodec/jbig2/JBig2_PddProc.h" #include <memory>
diff --git a/core/fxcodec/jbig2/JBig2_SddProc.cpp b/core/fxcodec/jbig2/JBig2_SddProc.cpp index c04d78a..19632f8 100644 --- a/core/fxcodec/jbig2/JBig2_SddProc.cpp +++ b/core/fxcodec/jbig2/JBig2_SddProc.cpp
@@ -4,11 +4,6 @@ // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com -#if defined(UNSAFE_BUFFERS_BUILD) -// TODO(crbug.com/pdfium/2154): resolve buffer safety issues. -#pragma allow_unsafe_buffers -#endif - #include "core/fxcodec/jbig2/JBig2_SddProc.h" #include <stddef.h> @@ -132,7 +127,8 @@ pDecoder->SBSYMCODELEN = SBSYMCODELEN; std::vector<CJBig2_Image*> SBSYMS; // Pointers are not owned SBSYMS.resize(pDecoder->SBNUMSYMS); - std::copy(SDINSYMS, SDINSYMS + SDNUMINSYMS, SBSYMS.begin()); + std::copy(SDINSYMS, UNSAFE_TODO(SDINSYMS + SDNUMINSYMS), + SBSYMS.begin()); for (size_t i = 0; i < NSYMSDECODED; ++i) SBSYMS[i + SDNUMINSYMS] = SDNEWSYMS[i].get(); pDecoder->SBSYMS = SBSYMS.data(); @@ -236,8 +232,9 @@ if (!EXFLAGS[i] || j >= SDNUMEXSYMS) continue; if (i < SDNUMINSYMS) { - pDict->AddImage(SDINSYMS[i] ? std::make_unique<CJBig2_Image>(*SDINSYMS[i]) - : nullptr); + pDict->AddImage( + UNSAFE_TODO(SDINSYMS[i] ? std::make_unique<CJBig2_Image>(*SDINSYMS[i]) + : nullptr)); } else { pDict->AddImage(std::move(SDNEWSYMS[i - SDNUMINSYMS])); } @@ -326,7 +323,8 @@ pDecoder->SBSYMCODES = std::move(SBSYMCODES); std::vector<CJBig2_Image*> SBSYMS; // Pointers are not owned SBSYMS.resize(pDecoder->SBNUMSYMS); - std::copy(SDINSYMS, SDINSYMS + SDNUMINSYMS, SBSYMS.begin()); + std::copy(SDINSYMS, UNSAFE_TODO(SDINSYMS + SDNUMINSYMS), + SBSYMS.begin()); for (size_t i = 0; i < NSYMSDECODED; ++i) SBSYMS[i + SDNUMINSYMS] = SDNEWSYMS[i].get(); pDecoder->SBSYMS = SBSYMS.data(); @@ -442,8 +440,8 @@ BHC = std::make_unique<CJBig2_Image>(TOTWIDTH, HCHEIGHT); for (uint32_t i = 0; i < HCHEIGHT; ++i) { - FXSYS_memcpy(BHC->data() + i * BHC->stride(), pStream->getPointer(), - stride); + UNSAFE_TODO(FXSYS_memcpy(BHC->data() + i * BHC->stride(), + pStream->getPointer(), stride)); pStream->offset(stride); } } else { @@ -498,8 +496,9 @@ if (!EXFLAGS[i] || j >= SDNUMEXSYMS) continue; if (i < SDNUMINSYMS) { - pDict->AddImage(SDINSYMS[i] ? std::make_unique<CJBig2_Image>(*SDINSYMS[i]) - : nullptr); + pDict->AddImage( + UNSAFE_TODO(SDINSYMS[i] ? std::make_unique<CJBig2_Image>(*SDINSYMS[i]) + : nullptr)); } else { pDict->AddImage(std::move(SDNEWSYMS[i - SDNUMINSYMS])); } @@ -511,5 +510,6 @@ CJBig2_Image* CJBig2_SDDProc::GetImage( uint32_t i, pdfium::span<const std::unique_ptr<CJBig2_Image>> new_syms) const { - return i < SDNUMINSYMS ? SDINSYMS[i] : new_syms[i - SDNUMINSYMS].get(); + return i < SDNUMINSYMS ? UNSAFE_TODO(SDINSYMS[i]) + : new_syms[i - SDNUMINSYMS].get(); }
diff --git a/core/fxcodec/jbig2/JBig2_SddProc.h b/core/fxcodec/jbig2/JBig2_SddProc.h index d8fd50b..fea5c0a 100644 --- a/core/fxcodec/jbig2/JBig2_SddProc.h +++ b/core/fxcodec/jbig2/JBig2_SddProc.h
@@ -9,6 +9,7 @@ #include <stdint.h> +#include <array> #include <memory> #include <vector> @@ -49,8 +50,8 @@ UnownedPtr<const CJBig2_HuffmanTable> SDHUFFDW; UnownedPtr<const CJBig2_HuffmanTable> SDHUFFBMSIZE; UnownedPtr<const CJBig2_HuffmanTable> SDHUFFAGGINST; - int8_t SDAT[8]; - int8_t SDRAT[4]; + std::array<int8_t, 8> SDAT; + std::array<int8_t, 4> SDRAT; private: // Reads from `SDINSYMS` if `i` is in-bounds. Otherwise, reduce `i` by
diff --git a/core/fxcodec/jbig2/JBig2_TrdProc.cpp b/core/fxcodec/jbig2/JBig2_TrdProc.cpp index f439d02..18c9523 100644 --- a/core/fxcodec/jbig2/JBig2_TrdProc.cpp +++ b/core/fxcodec/jbig2/JBig2_TrdProc.cpp
@@ -4,11 +4,6 @@ // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com -#if defined(UNSAFE_BUFFERS_BUILD) -// TODO(crbug.com/pdfium/2154): resolve buffer safety issues. -#pragma allow_unsafe_buffers -#endif - #include "core/fxcodec/jbig2/JBig2_TrdProc.h" #include <memory> @@ -18,6 +13,7 @@ #include "core/fxcodec/jbig2/JBig2_ArithIntDecoder.h" #include "core/fxcodec/jbig2/JBig2_GrrdProc.h" #include "core/fxcodec/jbig2/JBig2_HuffmanDecoder.h" +#include "core/fxcrt/compiler_specific.h" #include "core/fxcrt/fx_safe_types.h" #include "core/fxcrt/maybe_owned.h" @@ -144,7 +140,7 @@ MaybeOwned<CJBig2_Image> IBI; if (RI == 0) { - IBI = SBSYMS[IDI]; + IBI = UNSAFE_TODO(SBSYMS[IDI]); } else { int32_t RDWI; int32_t RDHI; @@ -160,7 +156,7 @@ } pStream->alignByte(); uint32_t nTmp = pStream->getOffset(); - CJBig2_Image* IBOI = SBSYMS[IDI]; + CJBig2_Image* IBOI = UNSAFE_TODO(SBSYMS[IDI]); if (!IBOI) return nullptr; @@ -330,7 +326,7 @@ MaybeOwned<CJBig2_Image> pIBI; if (RI == 0) { - pIBI = SBSYMS[IDI]; + pIBI = UNSAFE_TODO(SBSYMS[IDI]); } else { int32_t RDWI; int32_t RDHI; @@ -340,7 +336,7 @@ pIARDH->Decode(pArithDecoder, &RDHI); pIARDX->Decode(pArithDecoder, &RDXI); pIARDY->Decode(pArithDecoder, &RDYI); - CJBig2_Image* IBOI = SBSYMS[IDI]; + CJBig2_Image* IBOI = UNSAFE_TODO(SBSYMS[IDI]); if (!IBOI) return nullptr;
diff --git a/core/fxcodec/jbig2/JBig2_TrdProc.h b/core/fxcodec/jbig2/JBig2_TrdProc.h index bd887d9..eec22e4 100644 --- a/core/fxcodec/jbig2/JBig2_TrdProc.h +++ b/core/fxcodec/jbig2/JBig2_TrdProc.h
@@ -9,6 +9,7 @@ #include <stdint.h> +#include <array> #include <memory> #include <vector> @@ -83,7 +84,7 @@ UnownedPtr<const CJBig2_HuffmanTable> SBHUFFRDX; UnownedPtr<const CJBig2_HuffmanTable> SBHUFFRDY; UnownedPtr<const CJBig2_HuffmanTable> SBHUFFRSIZE; - int8_t SBRAT[4]; + std::array<int8_t, 4> SBRAT; private: struct ComposeData {
diff --git a/core/fxcodec/jbig2/jbig2_decoder.cpp b/core/fxcodec/jbig2/jbig2_decoder.cpp index d103a37..073f2b7 100644 --- a/core/fxcodec/jbig2/jbig2_decoder.cpp +++ b/core/fxcodec/jbig2/jbig2_decoder.cpp
@@ -4,15 +4,11 @@ // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com -#if defined(UNSAFE_BUFFERS_BUILD) -// TODO(crbug.com/pdfium/2154): resolve buffer safety issues. -#pragma allow_unsafe_buffers -#endif - #include "core/fxcodec/jbig2/jbig2_decoder.h" #include "core/fxcodec/jbig2/JBig2_Context.h" #include "core/fxcodec/jbig2/JBig2_DocumentContext.h" +#include "core/fxcrt/compiler_specific.h" #include "core/fxcrt/fx_2d_size.h" #include "core/fxcrt/span_util.h" @@ -31,8 +27,9 @@ int dword_size = pJbig2Context->m_height * pJbig2Context->m_dest_pitch / 4; uint32_t* dword_buf = reinterpret_cast<uint32_t*>(pJbig2Context->m_dest_buf); - for (int i = 0; i < dword_size; i++) - dword_buf[i] = ~dword_buf[i]; + for (int i = 0; i < dword_size; i++) { + UNSAFE_TODO(dword_buf[i] = ~dword_buf[i]); + } return FXCODEC_STATUS::kDecodeFinished; }