commit 49363202ce06ca9ff418b4df384cffadf924303c
author Henrique Nakashima <hnakashima@chromium.org> Fri Jan 26 15:42:59 2018 +0000
committer Chromium commit bot <commit-bot@chromium.org> Fri Jan 26 15:42:59 2018 +0000
tree 9830590cf450f4bd264ce1cf80921aa46b38da3b
parent 30f213e89d4e7ff67e09eaae592614cddba0809a

Fix crash in palette loading with Pattern colorspace.

Bug: chromium:804155
Change-Id: Ie70e93116696e3c4db987a10b8fc31b1af8aea70
Reviewed-on: https://pdfium-review.googlesource.com/23990
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: Ryan Harrison <rharrison@chromium.org>

core/fpdfapi/render/cpdf_dibsource.cpp

diff --git a/core/fpdfapi/render/cpdf_dibsource.cpp b/core/fpdfapi/render/cpdf_dibsource.cpp
index c1b9607..aff63d1 100644
--- a/core/fpdfapi/render/cpdf_dibsource.cpp
+++ b/core/fpdfapi/render/cpdf_dibsource.cpp
@@ -686,7 +686,7 @@
   m_pMaskStream = m_pDict->GetStreamFor("SMask");
   if (m_pMaskStream) {
     CPDF_Array* pMatte = m_pMaskStream->GetDict()->GetArrayFor("Matte");
-    if (pMatte && m_pColorSpace &&
+    if (pMatte && m_pColorSpace && m_Family != PDFCS_PATTERN &&
         m_pColorSpace->CountComponents() <= m_nComponents) {
       float R, G, B;
       std::vector<float> colors(m_nComponents);
@@ -752,6 +752,9 @@
   if (!m_pColorSpace) {
     return;
   }
+  if (m_Family == PDFCS_PATTERN)
+    return;
+
   if (m_bpc * m_nComponents == 1) {
     if (m_bDefaultDecode &&
         (m_Family == PDFCS_DEVICEGRAY || m_Family == PDFCS_DEVICERGB)) {
@@ -922,7 +925,7 @@
         R = (1.0f - color_values[0]) * k;
         G = (1.0f - color_values[1]) * k;
         B = (1.0f - color_values[2]) * k;
-      } else {
+      } else if (m_Family != PDFCS_PATTERN) {
         m_pColorSpace->GetRGB(color_values, &R, &G, &B);
       }
       R = ClampValue(R, 1.0f);
@@ -948,7 +951,7 @@
         R = (1.0f - color_values[0]) * k;
         G = (1.0f - color_values[1]) * k;
         B = (1.0f - color_values[2]) * k;
-      } else {
+      } else if (m_Family != PDFCS_PATTERN) {
         m_pColorSpace->GetRGB(color_values, &R, &G, &B);
       }
       R = ClampValue(R, 1.0f);