commit 94ac0bca68d8739e8b339d491a4823e7c67c13d3
author Tom Sepez <tsepez@chromium.org> Fri Oct 15 23:57:25 2021 +0000
committer Pdfium LUCI CQ <pdfium-scoped@luci-project-accounts.iam.gserviceaccount.com> Fri Oct 15 23:57:25 2021 +0000
tree 183ae5ae8308e652784c7be51c001c0cea283a79
parent 856fd0a23ed83549af63ebf7ee3d379bdbc4e220

Clamp indicies within scanline in DrawGouraud().

Then re-enable spans that were removed to satisfy the constraints
in the ref'd bug.

Bug: chromium:1258330
Change-Id: I5c88ad2f028754694ef367796d11f08f0c00865c
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/85910
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>

core/fpdfapi/render/cpdf_rendershading.cpp

diff --git a/core/fpdfapi/render/cpdf_rendershading.cpp b/core/fpdfapi/render/cpdf_rendershading.cpp
index 8c9a014..78ed8b2 100644
--- a/core/fpdfapi/render/cpdf_rendershading.cpp
+++ b/core/fpdfapi/render/cpdf_rendershading.cpp
@@ -33,6 +33,7 @@
 #include "core/fxge/dib/fx_dib.h"
 #include "third_party/base/check.h"
 #include "third_party/base/check_op.h"
+#include "third_party/base/cxx17_backports.h"
 #include "third_party/base/span.h"
 
 namespace {
@@ -388,24 +389,26 @@
       end_index = 0;
     }
 
-    int start_x = std::max(min_x, 0);
-    int end_x = std::min(max_x, pBitmap->GetWidth());
-
-    uint8_t* dib_buf = pBitmap->GetWritableScanline(y).data() + start_x * 4;
+    int start_x = pdfium::clamp(min_x, 0, pBitmap->GetWidth());
+    int end_x = pdfium::clamp(max_x, 0, pBitmap->GetWidth());
     float r_unit = (r[end_index] - r[start_index]) / (max_x - min_x);
     float g_unit = (g[end_index] - g[start_index]) / (max_x - min_x);
     float b_unit = (b[end_index] - b[start_index]) / (max_x - min_x);
     float r_result = r[start_index] + (start_x - min_x) * r_unit;
     float g_result = g[start_index] + (start_x - min_x) * g_unit;
     float b_result = b[start_index] + (start_x - min_x) * b_unit;
+    pdfium::span<uint8_t> dib_span =
+        pBitmap->GetWritableScanline(y).subspan(start_x * 4);
+
     for (int x = start_x; x < end_x; x++) {
+      uint8_t* dib_buf = dib_span.data();
       r_result += r_unit;
       g_result += g_unit;
       b_result += b_unit;
       FXARGB_SETDIB(dib_buf, ArgbEncode(alpha, static_cast<int>(r_result * 255),
                                         static_cast<int>(g_result * 255),
                                         static_cast<int>(b_result * 255)));
-      dib_buf += 4;
+      dib_span = dib_span.subspan(4);
     }
   }
 }