commit 3e08c2abb7039f6ad73538158e00697b7f9beea8
author Lei Zhang <thestig@chromium.org> Thu Nov 03 18:06:18 2022 +0000
committer Pdfium LUCI CQ <pdfium-scoped@luci-project-accounts.iam.gserviceaccount.com> Thu Nov 03 18:06:18 2022 +0000
tree a25695e051d58b04177223333e16c38df5806bec
parent 5fdfb25eb56bfb13d487f053e42033c5a887b57d

Avoid fatal OOM in CStretchEngine::StartStretchHorz().

Before https://pdfium-review.googlesource.com/100310, StartStretchHorz()
was a bit too conservative with its memory allocation limit and failed
for some legitimate use cases where PDFium had enough memory. Now, that
limit has been lifted and sometimes PDFium tries to allocate too much
memory. Instead of making this fatal, fail gracefully by switching from
DataVector to FixedTryAllocZeroedDataVector.

Bug: chromium:1380502
Change-Id: Ib0e616806738f1a905fe58a332ae8e2ffcea4d73
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/100590
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

core/fxge/dib/cstretchengine.cpp

diff --git a/core/fxge/dib/cstretchengine.cpp b/core/fxge/dib/cstretchengine.cpp
index 4acd692..a7632b1 100644
--- a/core/fxge/dib/cstretchengine.cpp
+++ b/core/fxge/dib/cstretchengine.cpp
@@ -280,7 +280,10 @@
   if (size == 0)
     return false;
 
-  m_InterBuf.resize(size);
+  m_InterBuf = FixedTryAllocZeroedDataVector<uint8_t>(size);
+  if (m_InterBuf.empty())
+    return false;
+
   if (m_pSource && m_bHasAlpha && m_pSource->HasAlphaMask()) {
     m_ExtraAlphaBuf.resize(m_SrcClip.Height(), m_ExtraMaskPitch);
     m_DestMaskScanline.resize(m_ExtraMaskPitch);
@@ -313,9 +316,8 @@
     }
 
     const uint8_t* src_scan = m_pSource->GetScanline(m_CurRow).data();
-    pdfium::span<uint8_t> dest_span =
-        pdfium::make_span(m_InterBuf)
-            .subspan((m_CurRow - m_SrcClip.top) * m_InterPitch, m_InterPitch);
+    pdfium::span<uint8_t> dest_span = m_InterBuf.writable_span().subspan(
+        (m_CurRow - m_SrcClip.top) * m_InterPitch, m_InterPitch);
     size_t dest_span_index = 0;
     const uint8_t* src_scan_mask = nullptr;
     uint8_t* dest_scan_mask = nullptr;
@@ -495,8 +497,7 @@
       case TransformMethod::k8BppTo8Bpp: {
         for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
           pdfium::span<const uint8_t> src_span =
-              pdfium::make_span(m_InterBuf)
-                  .subspan((col - m_DestClip.left) * DestBpp);
+              m_InterBuf.span().subspan((col - m_DestClip.left) * DestBpp);
           uint32_t dest_a = 0;
           for (int j = pWeights->m_SrcStart; j <= pWeights->m_SrcEnd; ++j) {
             uint32_t pixel_weight = pWeights->GetWeightForPosition(j);
@@ -511,8 +512,7 @@
       case TransformMethod::k8BppTo8BppWithAlpha: {
         for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
           pdfium::span<const uint8_t> src_span =
-              pdfium::make_span(m_InterBuf)
-                  .subspan((col - m_DestClip.left) * DestBpp);
+              m_InterBuf.span().subspan((col - m_DestClip.left) * DestBpp);
           unsigned char* src_scan_mask =
               m_ExtraAlphaBuf.data() + (col - m_DestClip.left);
           uint32_t dest_a = 0;
@@ -534,8 +534,7 @@
       case TransformMethod::kManyBpptoManyBpp: {
         for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
           pdfium::span<const uint8_t> src_span =
-              pdfium::make_span(m_InterBuf)
-                  .subspan((col - m_DestClip.left) * DestBpp);
+              m_InterBuf.span().subspan((col - m_DestClip.left) * DestBpp);
           uint32_t dest_r = 0;
           uint32_t dest_g = 0;
           uint32_t dest_b = 0;
@@ -558,8 +557,7 @@
       case TransformMethod::kManyBpptoManyBppWithAlpha: {
         for (int col = m_DestClip.left; col < m_DestClip.right; ++col) {
           pdfium::span<const uint8_t> src_span =
-              pdfium::make_span(m_InterBuf)
-                  .subspan((col - m_DestClip.left) * DestBpp);
+              m_InterBuf.span().subspan((col - m_DestClip.left) * DestBpp);
           unsigned char* src_scan_mask = nullptr;
           if (m_DestFormat != FXDIB_Format::kArgb)
             src_scan_mask = m_ExtraAlphaBuf.data() + (col - m_DestClip.left);

core/fxge/dib/cstretchengine.h

diff --git a/core/fxge/dib/cstretchengine.h b/core/fxge/dib/cstretchengine.h
index 2a38b94..7ddd76b 100644
--- a/core/fxge/dib/cstretchengine.h
+++ b/core/fxge/dib/cstretchengine.h
@@ -10,6 +10,7 @@
 #include <stdint.h>
 
 #include "core/fxcrt/data_vector.h"
+#include "core/fxcrt/fixed_try_alloc_zeroed_data_vector.h"
 #include "core/fxcrt/fx_coordinates.h"
 #include "core/fxcrt/fx_system.h"
 #include "core/fxcrt/retain_ptr.h"
@@ -152,7 +153,7 @@
   const FX_RECT m_DestClip;
   DataVector<uint8_t> m_DestScanline;
   DataVector<uint8_t> m_DestMaskScanline;
-  DataVector<uint8_t> m_InterBuf;
+  FixedTryAllocZeroedDataVector<uint8_t> m_InterBuf;
   DataVector<uint8_t> m_ExtraAlphaBuf;
   FX_RECT m_SrcClip;
   int m_InterPitch;