commit 5432df12534f018124ee51411670a722d6601f2b
author Tom Sepez <tsepez@chromium.org> Tue Jun 04 23:42:28 2024 +0000
committer Pdfium LUCI CQ <pdfium-scoped@luci-project-accounts.iam.gserviceaccount.com> Tue Jun 04 23:42:28 2024 +0000
tree 14e4cb222caa3c36720ed18a710c57c286ad8619
parent 4d445d7e6882e85c976e5df8681f8f1f10a98ee2

Mark fxcodec::ReverseRGB() as UNSAFE_BUFFER_USAGE.

Then remove file-level suppression of warnings.

Bug: 42271175
Change-Id: I39ce0e80faaf23b14b7c3f4c763d836b98a4a8ac
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/120131
Reviewed-by: Thomas Sepez <tsepez@google.com>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>

core/fpdfapi/page/cpdf_colorspace.cpp

diff --git a/core/fpdfapi/page/cpdf_colorspace.cpp b/core/fpdfapi/page/cpdf_colorspace.cpp
index d36ca2e..c0af2f6 100644
--- a/core/fpdfapi/page/cpdf_colorspace.cpp
+++ b/core/fpdfapi/page/cpdf_colorspace.cpp
@@ -837,7 +837,7 @@
 
   uint8_t* pDestBuf = dest_span.data();
   const uint8_t* pSrcBuf = src_span.data();
-  fxcodec::ReverseRGB(pDestBuf, pSrcBuf, pixels);
+  UNSAFE_TODO(fxcodec::ReverseRGB(pDestBuf, pSrcBuf, pixels));
 }
 
 CPDF_LabCS::CPDF_LabCS() : CPDF_ColorSpace(Family::kLab) {}
@@ -1031,7 +1031,7 @@
   CHECK(!bTransMask);  // Only applies to CMYK colorspaces.
 
   if (profile_->IsSRGB()) {
-    fxcodec::ReverseRGB(dest_span.data(), src_span.data(), pixels);
+    UNSAFE_TODO(fxcodec::ReverseRGB(dest_span.data(), src_span.data(), pixels));
     return;
   }
   if (!profile_->IsSupported()) {

core/fpdfapi/page/cpdf_devicecs.cpp

diff --git a/core/fpdfapi/page/cpdf_devicecs.cpp b/core/fpdfapi/page/cpdf_devicecs.cpp
index 7339074..70971ac 100644
--- a/core/fpdfapi/page/cpdf_devicecs.cpp
+++ b/core/fpdfapi/page/cpdf_devicecs.cpp
@@ -15,6 +15,7 @@
 #include "core/fpdfapi/parser/cpdf_string.h"
 #include "core/fxcodec/fx_codec.h"
 #include "core/fxcrt/check.h"
+#include "core/fxcrt/compiler_specific.h"
 #include "core/fxcrt/notreached.h"
 #include "core/fxge/dib/cfx_cmyk_to_srgb.h"
 
@@ -109,7 +110,8 @@
       break;
     case Family::kDeviceRGB:
       CHECK(!bTransMask);  // bTransMask only allowed for CMYK colorspaces.
-      fxcodec::ReverseRGB(dest_span.data(), src_span.data(), pixels);
+      UNSAFE_TODO(
+          fxcodec::ReverseRGB(dest_span.data(), src_span.data(), pixels));
       break;
     case Family::kDeviceCMYK: {
       auto cmyk_in =

core/fxcodec/fx_codec.cpp

diff --git a/core/fxcodec/fx_codec.cpp b/core/fxcodec/fx_codec.cpp
index 521a22a..1e4de6e 100644
--- a/core/fxcodec/fx_codec.cpp
+++ b/core/fxcodec/fx_codec.cpp
@@ -4,11 +4,6 @@
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
-#if defined(UNSAFE_BUFFERS_BUILD)
-// TODO(crbug.com/pdfium/2154): resolve buffer safety issues.
-#pragma allow_unsafe_buffers
-#endif
-
 #include "core/fxcodec/fx_codec.h"
 
 #include <utility>
@@ -24,18 +19,21 @@
 #endif  // PDF_ENABLE_XFA
 
 void ReverseRGB(uint8_t* pDestBuf, const uint8_t* pSrcBuf, int pixels) {
-  if (pDestBuf == pSrcBuf) {
-    for (int i = 0; i < pixels; i++) {
-      std::swap(pDestBuf[0], pDestBuf[2]);
-      pDestBuf += 3;
+  // SAFETY: required from caller, enforced by UNSAFE_BUFFER_USAGE in header.
+  UNSAFE_BUFFERS({
+    if (pDestBuf == pSrcBuf) {
+      for (int i = 0; i < pixels; i++) {
+        std::swap(pDestBuf[0], pDestBuf[2]);
+        pDestBuf += 3;
+      }
+    } else {
+      for (int i = 0; i < pixels; i++) {
+        ReverseCopy3Bytes(pDestBuf, pSrcBuf);
+        pDestBuf += 3;
+        pSrcBuf += 3;
+      }
     }
-  } else {
-    for (int i = 0; i < pixels; i++) {
-      ReverseCopy3Bytes(pDestBuf, pSrcBuf);
-      pDestBuf += 3;
-      pSrcBuf += 3;
-    }
-  }
+  });
 }
 
 }  // namespace fxcodec

core/fxcodec/fx_codec.h

diff --git a/core/fxcodec/fx_codec.h b/core/fxcodec/fx_codec.h
index b102b43..e2f2f47 100644
--- a/core/fxcodec/fx_codec.h
+++ b/core/fxcodec/fx_codec.h
@@ -9,6 +9,8 @@
 
 #include <stdint.h>
 
+#include "core/fxcrt/compiler_specific.h"
+
 namespace fxcodec {
 
 #ifdef PDF_ENABLE_XFA
@@ -32,7 +34,9 @@
 };
 #endif  // PDF_ENABLE_XFA
 
-void ReverseRGB(uint8_t* pDestBuf, const uint8_t* pSrcBuf, int pixels);
+UNSAFE_BUFFER_USAGE void ReverseRGB(uint8_t* pDestBuf,
+                                    const uint8_t* pSrcBuf,
+                                    int pixels);
 
 }  // namespace fxcodec