commit 3a0a808ff546b5633a2384f4ed156b7ced605c90
author kcwu <kcwu@chromium.org> Thu Oct 06 12:29:17 2016 -0700
committer Commit bot <commit-bot@chromium.org> Thu Oct 06 12:29:17 2016 -0700
tree 952915b8caab0d74812573d2cbd03cf38404a709
parent 587ec1975017ecbf13c1c3faf64c1008a95846f2

Fix assertion failure when decoding malform G4 fax image

The position indexes of color elements must be monotonic increasing.
Bail out if the decoded index is less or equal to the previous index.

BUG=pdfium:615

Review-Url: https://codereview.chromium.org/2398033002

core/fxcodec/codec/fx_codec_fax.cpp

diff --git a/core/fxcodec/codec/fx_codec_fax.cpp b/core/fxcodec/codec/fx_codec_fax.cpp
index 336c35b..c121478 100644
--- a/core/fxcodec/codec/fx_codec_fax.cpp
+++ b/core/fxcodec/codec/fx_codec_fax.cpp
@@ -390,6 +390,10 @@
     if (a1 >= columns)
       return TRUE;
 
+    // The position of picture element must be monotonic increasing.
+    if (a0 >= a1)
+      return FALSE;
+
     a0 = a1;
     a0color = !a0color;
   }