commit b6aa0742e27f9d2164bda49f5b83587e6ff12769
author Lei Zhang <thestig@chromium.org> Tue Nov 12 23:15:31 2019 +0000
committer Chromium commit bot <commit-bot@chromium.org> Tue Nov 12 23:15:31 2019 +0000
tree d1f7466af4db1dc332b5fe17fedbb6e93cb760f6
parent 2a444e1a0c1d670c5fab83db0701824ec2e784fd

Fix crash in FPDFPageObj_GetFillColor().

Calling FPDFPageObj_GetFillColor() on an image object triggers a crash.
Avoid that and return false. Apply the same fix to
FPDFPageObj_GetStrokeColor(). Add an embedder test for this case.

Bug: pdfium:1421
Change-Id: I62bd33b849434bdbb66830b9fe4549a0ef71f751
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/62355
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

fpdfsdk/fpdf_editpage.cpp

diff --git a/fpdfsdk/fpdf_editpage.cpp b/fpdfsdk/fpdf_editpage.cpp
index 0917b64..e99218d 100644
--- a/fpdfsdk/fpdf_editpage.cpp
+++ b/fpdfsdk/fpdf_editpage.cpp
@@ -703,10 +703,13 @@
   if (!pPageObj || !R || !G || !B || !A)
     return false;
 
-  FX_COLORREF fillColor = pPageObj->m_ColorState.GetFillColorRef();
-  *R = FXSYS_GetRValue(fillColor);
-  *G = FXSYS_GetGValue(fillColor);
-  *B = FXSYS_GetBValue(fillColor);
+  if (!pPageObj->m_ColorState.HasRef())
+    return false;
+
+  FX_COLORREF fill_color = pPageObj->m_ColorState.GetFillColorRef();
+  *R = FXSYS_GetRValue(fill_color);
+  *G = FXSYS_GetGValue(fill_color);
+  *B = FXSYS_GetBValue(fill_color);
   *A = FXSYS_GetUnsignedAlpha(pPageObj->m_GeneralState.GetFillAlpha());
   return true;
 }
@@ -757,10 +760,13 @@
   if (!pPageObj || !R || !G || !B || !A)
     return false;
 
-  FX_COLORREF strokeColor = pPageObj->m_ColorState.GetStrokeColorRef();
-  *R = FXSYS_GetRValue(strokeColor);
-  *G = FXSYS_GetGValue(strokeColor);
-  *B = FXSYS_GetBValue(strokeColor);
+  if (!pPageObj->m_ColorState.HasRef())
+    return false;
+
+  FX_COLORREF stroke_color = pPageObj->m_ColorState.GetStrokeColorRef();
+  *R = FXSYS_GetRValue(stroke_color);
+  *G = FXSYS_GetGValue(stroke_color);
+  *B = FXSYS_GetBValue(stroke_color);
   *A = FXSYS_GetUnsignedAlpha(pPageObj->m_GeneralState.GetStrokeAlpha());
   return true;
 }

fpdfsdk/fpdf_editpage_embeddertest.cpp

diff --git a/fpdfsdk/fpdf_editpage_embeddertest.cpp b/fpdfsdk/fpdf_editpage_embeddertest.cpp
index 6061ec6..6650b40 100644
--- a/fpdfsdk/fpdf_editpage_embeddertest.cpp
+++ b/fpdfsdk/fpdf_editpage_embeddertest.cpp
@@ -130,3 +130,28 @@
 
   UnloadPage(page);
 }
+
+TEST_F(FPDFEditPageEmbedderTest, GetFillAndStrokeForImage) {
+  constexpr int kExpectedObjectCount = 39;
+  constexpr int kImageObjectsStartIndex = 33;
+  ASSERT_TRUE(OpenDocument("embedded_images.pdf"));
+  FPDF_PAGE page = LoadPage(0);
+  ASSERT_TRUE(page);
+
+  ASSERT_EQ(kExpectedObjectCount, FPDFPage_CountObjects(page));
+
+  for (int i = kImageObjectsStartIndex; i < kExpectedObjectCount; ++i) {
+    FPDF_PAGEOBJECT image = FPDFPage_GetObject(page, i);
+    ASSERT_TRUE(image);
+    EXPECT_EQ(FPDF_PAGEOBJ_IMAGE, FPDFPageObj_GetType(image));
+
+    unsigned int r;
+    unsigned int g;
+    unsigned int b;
+    unsigned int a;
+    EXPECT_FALSE(FPDFPageObj_GetFillColor(image, &r, &g, &b, &a));
+    EXPECT_FALSE(FPDFPageObj_GetStrokeColor(image, &r, &g, &b, &a));
+  }
+
+  UnloadPage(page);
+}