commit 71a5a32d45f12733d8e1a072d1c6744c51fa654a
author Tom Sepez <tsepez@chromium.org> Mon Oct 11 18:29:57 2021 +0000
committer Pdfium LUCI CQ <pdfium-scoped@luci-project-accounts.iam.gserviceaccount.com> Mon Oct 11 18:29:57 2021 +0000
tree 9fe1ea2e6e6e9b0c2272aa7a50daa3647dff91ae
parent 5ea38ddd227842532d448882b9937a147415733b

Revert "Use spancpy() in CFX_DIBBase::Clone()."

This reverts commit aa7822513967ba139ce9e9fdf10ea8e00b7a621c.

Reason for revert: https://crbug.com/1258634

Avoid a check while we diagnose what CPDF_DIB is doing when it
thinks there are only two components to an image.

Original change's description:
> Use spancpy() in CFX_DIBBase::Clone().
>
> Had Clone() been coded like this originally, even without the safe
> arithmetic, the issue in https://pdfium-review.googlesource.com/85510
> would have caused a trap. The additional checks should be acceptable
> since they occur once per scanline and not once per pixel.
>
> Change-Id: I0b0c8b0977e6902a4c233b582cbdb01796871174
> Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/85555
> Commit-Queue: Tom Sepez <tsepez@chromium.org>
> Reviewed-by: Lei Zhang <thestig@chromium.org>

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I9e1ff0438b0d17e391f63c16a7d4b8a241b03b99
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/85850
Auto-Submit: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>

core/fxge/dib/cfx_dibbase.cpp

diff --git a/core/fxge/dib/cfx_dibbase.cpp b/core/fxge/dib/cfx_dibbase.cpp
index b29298f..45ce5d5 100644
--- a/core/fxge/dib/cfx_dibbase.cpp
+++ b/core/fxge/dib/cfx_dibbase.cpp
@@ -645,26 +645,27 @@
       }
     }
   } else {
-    FX_SAFE_UINT32 safe_copy_len = pNewBitmap->GetWidth();
-    safe_copy_len *= pNewBitmap->GetBPP();
-    safe_copy_len += 7;
-    safe_copy_len /= 8;
-    if (!safe_copy_len.IsValid())
+    FX_SAFE_UINT32 copy_len = pNewBitmap->GetWidth();
+    copy_len *= pNewBitmap->GetBPP();
+    copy_len += 7;
+    copy_len /= 8;
+    if (!copy_len.IsValid())
       return nullptr;
 
-    uint32_t copy_len = std::min<uint32_t>(m_Pitch, safe_copy_len.ValueOrDie());
+    copy_len = std::min<uint32_t>(m_Pitch, copy_len.ValueOrDie());
 
-    FX_SAFE_UINT32 safe_offset = rect.left;
-    safe_offset *= GetBppFromFormat(m_Format);
-    safe_offset /= 8;
-    if (!safe_offset.IsValid())
+    FX_SAFE_UINT32 offset = rect.left;
+    offset *= GetBppFromFormat(m_Format);
+    offset /= 8;
+    if (!offset.IsValid())
       return nullptr;
 
-    uint32_t offset = safe_offset.ValueOrDie();
-
     for (int row = rect.top; row < rect.bottom; ++row) {
-      fxcrt::spancpy(pNewBitmap->GetWritableScanline(row - rect.top),
-                     GetScanline(row).subspan(offset, copy_len));
+      const uint8_t* src_scan =
+          GetScanline(row).subspan(offset.ValueOrDie()).data();
+      uint8_t* dest_scan =
+          pNewBitmap->GetWritableScanline(row - rect.top).data();
+      memcpy(dest_scan, src_scan, copy_len.ValueOrDie());
     }
   }
   return pNewBitmap;