Fix bug_1395648.in expected image

Pdfium output is not consistent with other renderers.

In the in file, object 6 0, is an smask where only
the first line, and half of the second are set
- Pdfium only renders the first line
- Since the image is truncated, the remaining bytes
  are filled with 0xFF, causing all pixels of the image
  being painted to show up in the output

two fixes in this CL:
- read any remaining bytes in the buffer
- if the image is truncated, fill it with 0 instead of 0xFF

Bug: pdfium:1970
Change-Id: Iaf8f823c5d335e4c30a091571ac0eeb9223c67c3
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/103151
Reviewed-by: Nigi <nigi@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>
diff --git a/core/fpdfapi/page/cpdf_dib.cpp b/core/fpdfapi/page/cpdf_dib.cpp
index 6d1e66c..9d649c1 100644
--- a/core/fpdfapi/page/cpdf_dib.cpp
+++ b/core/fpdfapi/page/cpdf_dib.cpp
@@ -1072,20 +1072,33 @@
     return pdfium::span<const uint8_t>();
 
   uint32_t src_pitch_value = src_pitch.value();
+  // This is used as the buffer of `pSrcLine` when the stream is truncated,
+  // and the remaining bytes count is less than `src_pitch_value`
+  DataVector<uint8_t> temp_buffer;
   pdfium::span<const uint8_t> pSrcLine;
+
   if (m_pCachedBitmap && src_pitch_value <= m_pCachedBitmap->GetPitch()) {
     if (line >= m_pCachedBitmap->GetHeight())
       line = m_pCachedBitmap->GetHeight() - 1;
     pSrcLine = m_pCachedBitmap->GetScanline(line);
   } else if (m_pDecoder) {
     pSrcLine = m_pDecoder->GetScanline(line);
-  } else if (m_pStreamAcc->GetSize() >= (line + 1) * src_pitch_value) {
-    pSrcLine = m_pStreamAcc->GetSpan().subspan(line * src_pitch_value,
-                                               src_pitch_value);
+  } else if (m_pStreamAcc->GetSize() > line * src_pitch_value) {
+    pdfium::span<const uint8_t> remaining_bytes =
+        m_pStreamAcc->GetSpan().subspan(line * src_pitch_value);
+    if (remaining_bytes.size() >= src_pitch_value) {
+      pSrcLine = remaining_bytes.first(src_pitch_value);
+    } else {
+      temp_buffer = DataVector<uint8_t>(src_pitch_value);
+      pdfium::span<uint8_t> result = temp_buffer;
+      fxcrt::spancpy(result, remaining_bytes);
+      pSrcLine = result;
+    }
   }
+
   if (pSrcLine.empty()) {
     pdfium::span<uint8_t> result = !m_MaskBuf.empty() ? m_MaskBuf : m_LineBuf;
-    fxcrt::spanset(result, 0xFF);
+    fxcrt::spanset(result, 0);
     return result;
   }
   if (m_bpc * m_nComponents == 1) {
diff --git a/testing/resources/pixel/bug_1236805_expected.pdf.0.png b/testing/resources/pixel/bug_1236805_expected.pdf.0.png
index 589822f..7d4eebe 100644
--- a/testing/resources/pixel/bug_1236805_expected.pdf.0.png
+++ b/testing/resources/pixel/bug_1236805_expected.pdf.0.png
Binary files differ
diff --git a/testing/resources/pixel/bug_1236805_expected_skia.pdf.0.png b/testing/resources/pixel/bug_1236805_expected_skia.pdf.0.png
deleted file mode 100644
index 4f7440d..0000000
--- a/testing/resources/pixel/bug_1236805_expected_skia.pdf.0.png
+++ /dev/null
Binary files differ
diff --git a/testing/resources/pixel/bug_1395648_expected.pdf.0.png b/testing/resources/pixel/bug_1395648_expected.pdf.0.png
index 3c432f0..4aca65e 100644
--- a/testing/resources/pixel/bug_1395648_expected.pdf.0.png
+++ b/testing/resources/pixel/bug_1395648_expected.pdf.0.png
Binary files differ
diff --git a/testing/resources/pixel/bug_1395648_expected_skia.pdf.0.png b/testing/resources/pixel/bug_1395648_expected_skia.pdf.0.png
index 436cb2f..6af289a 100644
--- a/testing/resources/pixel/bug_1395648_expected_skia.pdf.0.png
+++ b/testing/resources/pixel/bug_1395648_expected_skia.pdf.0.png
Binary files differ
diff --git a/testing/resources/pixel/bug_554151_expected.pdf.0.png b/testing/resources/pixel/bug_554151_expected.pdf.0.png
index 08c11b0..5b99a4d 100644
--- a/testing/resources/pixel/bug_554151_expected.pdf.0.png
+++ b/testing/resources/pixel/bug_554151_expected.pdf.0.png
Binary files differ