commit dc911ef710bc0cbe718770f0726d28ac08d4d3be
author Tom Sepez <tsepez@chromium.org> Wed Jun 09 17:38:57 2021 +0000
committer Pdfium LUCI CQ <pdfium-scoped@luci-project-accounts.iam.gserviceaccount.com> Wed Jun 09 17:38:57 2021 +0000
tree fc6a444cdaa1b018303fad9e1c828b8e78d7a650
parent 3d4afc9ee33ba0dd07371ed802c81a07e23affef

Remove some unreachable code from progressive_decoder.cpp

ProgressiveDecoder::WeightTable::Calc() runs the risk of passing a
negative length parameter to resize() if the dest_len parameter is
less than 0. Fortunately, the only caller passes m_sizeX, which is
only set to a non-zero value from device_rc.Width() at line 2172.
We know this is non-negative since we checked size_x at line 2158
priot to setting up device_rc.

Convert to a check for non-negative values, and remove the
calculations involving `base` since we know that it will be zero.
Note that Calc() is uncomfortably similar to code in CStretchEngine,
but that does not have the same issue because the size is computed
from different parameters.

Change-Id: I7cc3d8672036150691f93a55e05659dc8168e3f6
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/81710
Auto-Submit: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>

core/fxcodec/progressive_decoder.cpp

diff --git a/core/fxcodec/progressive_decoder.cpp b/core/fxcodec/progressive_decoder.cpp
index d9b8dd4..91a36f9 100644
--- a/core/fxcodec/progressive_decoder.cpp
+++ b/core/fxcodec/progressive_decoder.cpp
@@ -68,15 +68,15 @@
 ProgressiveDecoder::WeightTable::~WeightTable() = default;
 
 void ProgressiveDecoder::WeightTable::Calc(int dest_len, int src_len) {
+  CHECK(dest_len >= 0);
   double scale = static_cast<double>(src_len) / dest_len;
-  double base = dest_len < 0 ? src_len : 0.0;
   m_ItemSize = (int)(sizeof(int) * 2 + sizeof(int) * (ceil(fabs(scale)) + 1));
   m_DestMin = 0;
   m_pWeightTables.resize(dest_len * m_ItemSize + 4);
   if (fabs(scale) < 1.0) {
     for (int dest_pixel = 0; dest_pixel < dest_len; dest_pixel++) {
       PixelWeight& pixel_weights = *GetPixelWeight(dest_pixel);
-      double src_pos = dest_pixel * scale + scale / 2 + base;
+      double src_pos = dest_pixel * scale + scale / 2;
       pixel_weights.m_SrcStart = (int)floor((float)src_pos - 1.0f / 2);
       pixel_weights.m_SrcEnd = (int)floor((float)src_pos + 1.0f / 2);
       pixel_weights.m_SrcStart = std::max(pixel_weights.m_SrcStart, 0);
@@ -93,7 +93,7 @@
   }
   for (int dest_pixel = 0; dest_pixel < dest_len; dest_pixel++) {
     PixelWeight& pixel_weights = *GetPixelWeight(dest_pixel);
-    double src_start = dest_pixel * scale + base;
+    double src_start = dest_pixel * scale;
     double src_end = src_start + scale;
     int start_i;
     int end_i;
@@ -114,8 +114,8 @@
     pixel_weights.m_SrcStart = start_i;
     pixel_weights.m_SrcEnd = end_i;
     for (int j = start_i; j <= end_i; j++) {
-      double dest_start = ((float)j - base) / scale;
-      double dest_end = ((float)(j + 1) - base) / scale;
+      double dest_start = ((float)j) / scale;
+      double dest_end = ((float)(j + 1)) / scale;
       if (dest_start > dest_end) {
         double temp = dest_start;
         dest_start = dest_end;
@@ -142,6 +142,7 @@
 ProgressiveDecoder::HorzTable::~HorzTable() = default;
 
 void ProgressiveDecoder::HorzTable::Calc(int dest_len, int src_len) {
+  CHECK(dest_len >= 0);
   double scale = (double)dest_len / (double)src_len;
   m_ItemSize = sizeof(int) * 4;
   int size = dest_len * m_ItemSize + 4;
@@ -195,6 +196,7 @@
 ProgressiveDecoder::VertTable::~VertTable() = default;
 
 void ProgressiveDecoder::VertTable::Calc(int dest_len, int src_len) {
+  CHECK(dest_len >= 0);
   double scale = (double)dest_len / (double)src_len;
   m_ItemSize = sizeof(int) * 4;
   int size = dest_len * m_ItemSize + 4;