commit 83a01491dbd91e31c9d9417b8b975259a0fb3aec
author Henrique Nakashima <hnakashima@chromium.org> Mon Mar 12 17:18:14 2018 +0000
committer Chromium commit bot <commit-bot@chromium.org> Mon Mar 12 17:18:14 2018 +0000
tree 2c8a8eb719f5c3810c1a0ca4c5feae78215bd501
parent 64c664387d71ed01d18ab2b23327bbdd9757bd46

Fix crash when creating a CFX_DIBitmap with FXDIB_Invalid.

Bug: chromium:820885
Change-Id: I3886c636b91a8499924d95ad47f4c832db9f9754
Reviewed-on: https://pdfium-review.googlesource.com/28491
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Henrique Nakashima <hnakashima@chromium.org>

BUILD.gn

diff --git a/BUILD.gn b/BUILD.gn
index d4e2d46..479971d 100644
--- a/BUILD.gn
+++ b/BUILD.gn
@@ -2903,6 +2903,7 @@
     "core/fxcrt/unowned_ptr_unittest.cpp",
     "core/fxcrt/weak_ptr_unittest.cpp",
     "core/fxcrt/widestring_unittest.cpp",
+    "core/fxge/dib/cfx_dibitmap_unittest.cpp",
     "core/fxge/dib/cstretchengine_unittest.cpp",
     "fpdfsdk/fpdfcatalog_unittest.cpp",
     "fpdfsdk/fpdfdoc_unittest.cpp",

core/fxge/dib/cfx_dibitmap.cpp

diff --git a/core/fxge/dib/cfx_dibitmap.cpp b/core/fxge/dib/cfx_dibitmap.cpp
index 857ca9a..a9764e7 100644
--- a/core/fxge/dib/cfx_dibitmap.cpp
+++ b/core/fxge/dib/cfx_dibitmap.cpp
@@ -819,7 +819,10 @@
   if (width <= 0 || height <= 0)
     return false;
 
-  if ((INT_MAX - 31) / width < (format & 0xFF))
+  if (!(format & 0xff))
+    return false;
+
+  if ((INT_MAX - 31) / width < (format & 0xff))
     return false;
 
   if (!*pitch)

core/fxge/dib/cfx_dibitmap_unittest.cpp

diff --git a/core/fxge/dib/cfx_dibitmap_unittest.cpp b/core/fxge/dib/cfx_dibitmap_unittest.cpp
new file mode 100644
index 0000000..67ca705
--- /dev/null
+++ b/core/fxge/dib/cfx_dibitmap_unittest.cpp
@@ -0,0 +1,15 @@
+// Copyright 2018 PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "core/fxge/dib/cfx_dibitmap.h"
+
+#include "testing/gtest/include/gtest/gtest.h"
+
+TEST(CFX_DIBitmap, Create) {
+  auto pBitmap = pdfium::MakeRetain<CFX_DIBitmap>();
+  EXPECT_FALSE(pBitmap->Create(400, 300, FXDIB_Invalid));
+
+  pBitmap = pdfium::MakeRetain<CFX_DIBitmap>();
+  EXPECT_TRUE(pBitmap->Create(400, 300, FXDIB_1bppRgb));
+}