Avoid an assertion failure in CPDF_DIBBase::StartLoadMask().
Check and make sure the /Matte array has exactly the required number of
elements. Add a pixel test for /Matte.
Bug: chromium:1013066
Change-Id: Ibacae9e135ed9ff0d595769ba77aeae256295fcf
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/61390
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
diff --git a/core/fpdfapi/page/cpdf_dibbase.cpp b/core/fpdfapi/page/cpdf_dibbase.cpp
index c4a59d4..599de4e 100644
--- a/core/fpdfapi/page/cpdf_dibbase.cpp
+++ b/core/fpdfapi/page/cpdf_dibbase.cpp
@@ -670,6 +670,7 @@
const CPDF_Array* pMatte = m_pMaskStream->GetDict()->GetArrayFor("Matte");
if (pMatte && m_pColorSpace && m_Family != PDFCS_PATTERN &&
+ pMatte->size() == m_nComponents &&
m_pColorSpace->CountComponents() <= m_nComponents) {
std::vector<float> colors =
ReadArrayElementsToVector(pMatte, m_nComponents);
diff --git a/testing/resources/pixel/matte.in b/testing/resources/pixel/matte.in
new file mode 100644
index 0000000..57d8e13
--- /dev/null
+++ b/testing/resources/pixel/matte.in
@@ -0,0 +1,172 @@
+{{header}}
+{{object 1 0}} <<
+ /Type /Catalog
+ /Pages 2 0 R
+>>
+endobj
+{{object 2 0}} <<
+ /Type /Pages
+ /Count 1
+ /Kids [3 0 R]
+>>
+endobj
+{{object 3 0}} <<
+ /Type /Page
+ /Parent 2 0 R
+ /MediaBox [0 0 100 150]
+ /Contents [4 0 R]
+ /Resources <<
+ /XObject <<
+ /Mask 5 0 R
+ /NoMask 7 0 R
+ /MaskTooFewComps 9 0 R
+ /MaskTooManyComps 11 0 R
+ >>
+ >>
+>>
+endobj
+{{object 4 0}} <<
+ {{streamlen}}
+>>
+stream
+q
+40 0 0 60 0 0 cm
+/Mask Do
+Q
+q
+40 0 0 60 50 0 cm
+/NoMask Do
+Q
+q
+40 0 0 60 0 90 cm
+/MaskTooFewComps Do
+Q
+q
+40 0 0 60 50 90 cm
+/MaskTooManyComps Do
+Q
+endstream
+endobj
+{{object 5 0}} <<
+ /Type /XObject
+ /Subtype /Image
+ /Width 50
+ /Height 50
+ /BitsPerComponent 8
+ /ColorSpace /DeviceRGB
+ /Filter [/ASCIIHexDecode /FlateDecode]
+ /SMask 6 0 R
+ {{streamlen}}
+>>
+stream
+789cedc2310d00000c03a07f2aaab3ea7bcf03842655555555555555f5bf01cc7818dc
+endstream
+endobj
+{{object 6 0}} <<
+ /Type /XObject
+ /Subtype /Image
+ /Width 50
+ /Height 50
+ /BitsPerComponent 8
+ /ColorSpace /DeviceGray
+ /Filter [/ASCIIHexDecode /FlateDecode]
+ /Matte [0.0 0.2 1]
+ {{streamlen}}
+>>
+stream
+789cabaa1a05a3808e4061148c027a028351300ae809a246c128a027e0020065c9c90d
+endstream
+endobj
+{{object 7 0}} <<
+ /Type /XObject
+ /Subtype /Image
+ /Width 50
+ /Height 50
+ /BitsPerComponent 8
+ /ColorSpace /DeviceRGB
+ /Filter [/ASCIIHexDecode /FlateDecode]
+ /SMask 8 0 R
+ {{streamlen}}
+>>
+stream
+789cedc2310d00000c03a07f2aaab3ea7bcf03842655555555555555f5bf01cc7818dc
+endstream
+endobj
+{{object 8 0}} <<
+ /Type /XObject
+ /Subtype /Image
+ /Width 50
+ /Height 50
+ /BitsPerComponent 8
+ /ColorSpace /DeviceGray
+ /Filter [/ASCIIHexDecode /FlateDecode]
+ {{streamlen}}
+>>
+stream
+789cabaa1a05a3808e4061148c027a028351300ae809a246c128a027e0020065c9c90d
+endstream
+endobj
+{{object 9 0}} <<
+ /Type /XObject
+ /Subtype /Image
+ /Width 50
+ /Height 50
+ /BitsPerComponent 8
+ /ColorSpace /DeviceRGB
+ /Filter [/ASCIIHexDecode /FlateDecode]
+ /SMask 10 0 R
+ {{streamlen}}
+>>
+stream
+789cedc2310d00000c03a07f2aaab3ea7bcf03842655555555555555f5bf01cc7818dc
+endstream
+endobj
+{{object 10 0}} <<
+ /Type /XObject
+ /Subtype /Image
+ /Width 50
+ /Height 50
+ /BitsPerComponent 8
+ /ColorSpace /DeviceGray
+ /Filter [/ASCIIHexDecode /FlateDecode]
+ /Matte [0.0 0.2]
+ {{streamlen}}
+>>
+stream
+789cabaa1a05a3808e4061148c027a028351300ae809a246c128a027e0020065c9c90d
+endstream
+endobj
+{{object 11 0}} <<
+ /Type /XObject
+ /Subtype /Image
+ /Width 50
+ /Height 50
+ /BitsPerComponent 8
+ /ColorSpace /DeviceRGB
+ /Filter [/ASCIIHexDecode /FlateDecode]
+ /SMask 12 0 R
+ {{streamlen}}
+>>
+stream
+789cedc2310d00000c03a07f2aaab3ea7bcf03842655555555555555f5bf01cc7818dc
+endstream
+endobj
+{{object 12 0}} <<
+ /Type /XObject
+ /Subtype /Image
+ /Width 50
+ /Height 50
+ /BitsPerComponent 8
+ /ColorSpace /DeviceGray
+ /Filter [/ASCIIHexDecode /FlateDecode]
+ /Matte [0.0 0.2 1 0.5]
+ {{streamlen}}
+>>
+stream
+789cabaa1a05a3808e4061148c027a028351300ae809a246c128a027e0020065c9c90d
+endstream
+endobj
+{{xref}}
+{{trailer}}
+{{startxref}}
+%%EOF
diff --git a/testing/resources/pixel/matte_expected.pdf.0.png b/testing/resources/pixel/matte_expected.pdf.0.png
new file mode 100644
index 0000000..41c46c0
--- /dev/null
+++ b/testing/resources/pixel/matte_expected.pdf.0.png
Binary files differ