commit c945ce43db0e14c9a146dff638c29ed9344bb858
author Lei Zhang <thestig@chromium.org> Wed Jun 19 18:34:04 2019 +0000
committer Chromium commit bot <commit-bot@chromium.org> Wed Jun 19 18:34:04 2019 +0000
tree 2db1c660391cb937dbda6572b926033f1269864e
parent bfaea27b96034c959e507098f68fbecaf61eeb3f

Simplify CLZWDecoder decoding.

- Check for the 0-byte output case in CLZWDecoder::Decode(), rather than
  separately by the caller.
- Do not bother allocating an extra byte in the output buffer for adding
  a NUL terminator. The call stack into CLZWDecoder is shared with many
  other decoders, and no other decoder does this. Also, the caller gets
  back the allocated array size, so it knows where the boundary is.

Change-Id: I86305416bf99052fd61334d51609ac550785285a
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/56490
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>

core/fxcodec/flate/flatemodule.cpp

diff --git a/core/fxcodec/flate/flatemodule.cpp b/core/fxcodec/flate/flatemodule.cpp
index 8100229..fb8b78c 100644
--- a/core/fxcodec/flate/flatemodule.cpp
+++ b/core/fxcodec/flate/flatemodule.cpp
@@ -240,6 +240,9 @@
     AddCode(old_code, last_char);
     old_code = code;
   }
+  if (dest_byte_pos_ == 0)
+    return false;
+
   *dest_size = dest_byte_pos_;
   *src_size = (src_bit_pos_ + 7) / 8;
   return true;
@@ -789,15 +792,12 @@
     auto decoder = pdfium::MakeUnique<CLZWDecoder>(src_span, bEarlyChange);
     *dest_size = 0xFFFFFFFF;
     offset = src_span.size();
-    bool success = decoder->Decode(nullptr, dest_size, &offset);
-    if (!success || *dest_size == 0 || *dest_size + 1 < *dest_size)
+    if (!decoder->Decode(nullptr, dest_size, &offset))
       return FX_INVALID_OFFSET;
 
     decoder = pdfium::MakeUnique<CLZWDecoder>(src_span, bEarlyChange);
-    dest_buf->reset(FX_Alloc(uint8_t, *dest_size + 1));
-    uint8_t* dest_buf_ptr = dest_buf->get();
-    dest_buf_ptr[*dest_size] = '\0';
-    decoder->Decode(dest_buf_ptr, dest_size, &offset);
+    dest_buf->reset(FX_Alloc(uint8_t, *dest_size));
+    decoder->Decode(dest_buf->get(), dest_size, &offset);
   } else {
     FlateUncompress(src_span, estimated_size, dest_buf, dest_size, &offset);
   }