Reduce scope of GetBGR() calls inside CFX_AggRenderer::CompositeSpan() Avoid calling GetBGR() for grayscale color data, which results in a bad variant access. Bug: 374218980 Change-Id: I3d40b0e40ba24fee34332a8191ba7e824ec55219 Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/125270 Commit-Queue: Lei Zhang <thestig@chromium.org> Reviewed-by: Tom Sepez <tsepez@chromium.org> Reviewed-by: Tom Sepez <tsepez@google.com>
diff --git a/core/fxge/agg/cfx_agg_devicedriver.cpp b/core/fxge/agg/cfx_agg_devicedriver.cpp index 5d78ed7..71662e3 100644 --- a/core/fxge/agg/cfx_agg_devicedriver.cpp +++ b/core/fxge/agg/cfx_agg_devicedriver.cpp
@@ -469,12 +469,12 @@ const uint8_t* cover_scan, const uint8_t* clip_scan) { CHECK(bytes_per_pixel); - const auto& bgr = GetBGR(); UNSAFE_TODO({ dest_scan += col_start * bytes_per_pixel; backdrop_scan += col_start * bytes_per_pixel; if (m_bRgbByteOrder) { if (bytes_per_pixel == 4 && bDestAlpha) { + const auto& bgr = GetBGR(); for (int col = col_start; col < col_end; col++) { int src_alpha = GetSrcAlpha(clip_scan, col); uint8_t dest_alpha = @@ -506,6 +506,7 @@ return; } if (bytes_per_pixel == 3 || bytes_per_pixel == 4) { + const auto& bgr = GetBGR(); for (int col = col_start; col < col_end; col++) { int src_alpha = GetSrcAlpha(clip_scan, col); int r = FXDIB_ALPHA_MERGE(*backdrop_scan++, bgr.red, src_alpha); @@ -523,6 +524,7 @@ return; } if (bytes_per_pixel == 4 && bDestAlpha) { + const auto& bgr = GetBGR(); for (int col = col_start; col < col_end; col++) { int src_alpha = GetSrcAlpha(clip_scan, col); int src_alpha_covered = src_alpha * cover_scan[col] / 255; @@ -558,6 +560,7 @@ return; } if (bytes_per_pixel == 3 || bytes_per_pixel == 4) { + const auto& bgr = GetBGR(); for (int col = col_start; col < col_end; col++) { int src_alpha = GetSrcAlpha(clip_scan, col); if (m_bFullCover) {