commit d0f42d7bfb7dc2bd44b5a988647a5fa056b5376d
author Lei Zhang <thestig@chromium.org> Mon Dec 12 20:13:03 2022 +0000
committer Pdfium LUCI CQ <pdfium-scoped@luci-project-accounts.iam.gserviceaccount.com> Mon Dec 12 20:13:03 2022 +0000
tree fd21ef1d87c5a4ce338e38f32a30e5b67c43f0e0
parent eef0a633bf3d9be625e387c1b51552d41b459166

Fix a regression in CFX_PSRenderer::FaxCompressData().

A refactoring CL [1] confused width and pitch in a calculation inside
CFX_PSRenderer::FaxCompressData(). As a result, PostScript with
/CCITTFaxDecode may be generated incorrectly. Restore the original
calculation to fix the problem.

Along the way, also default initialize `FaxCompressResult::compressed`
to prevent potential undefined behavior issues.

[1] https://pdfium.googlesource.com/pdfium/+/d8ede5f8d13af84bb5e359cf00a6f3fb035d5982

Bug: chromium:1399155
Change-Id: Ia694a6936cfeff2f1a702ce25acc4b901b2bcfce
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/102372
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

core/fxge/win32/cfx_psrenderer.cpp

diff --git a/core/fxge/win32/cfx_psrenderer.cpp b/core/fxge/win32/cfx_psrenderer.cpp
index 8f15ce4..ae168f4 100644
--- a/core/fxge/win32/cfx_psrenderer.cpp
+++ b/core/fxge/win32/cfx_psrenderer.cpp
@@ -840,26 +840,30 @@
   DCHECK_EQ(1, src->GetBPP());
 
   FaxCompressResult result;
+  const int width = src->GetWidth();
   const int height = src->GetHeight();
   const int pitch = src->GetPitch();
-  FX_SAFE_UINT32 safe_size = pitch;
-  safe_size *= height;
-  if (!safe_size.IsValid())
+  DCHECK_GE(width, pitch);
+
+  FX_SAFE_UINT32 safe_pixel_count = width;
+  safe_pixel_count *= height;
+  if (!safe_pixel_count.IsValid())
     return result;
 
-  if (safe_size.ValueOrDie() > 128) {
+  if (safe_pixel_count.ValueOrDie() > 128) {
     result.data = m_pEncoderIface->pFaxEncodeFunc(std::move(src));
     result.compressed = true;
     return result;
   }
 
+  FX_SAFE_UINT32 safe_size = pitch;
+  safe_size *= height;
   result.data.resize(safe_size.ValueOrDie());
   auto dest_span = pdfium::make_span(result.data);
   for (int row = 0; row < height; row++) {
     pdfium::span<const uint8_t> src_scan = src->GetScanline(row);
     fxcrt::spancpy(dest_span.subspan(row * pitch, pitch), src_scan);
   }
-  result.compressed = false;
   return result;
 }
 

core/fxge/win32/cfx_psrenderer.h

diff --git a/core/fxge/win32/cfx_psrenderer.h b/core/fxge/win32/cfx_psrenderer.h
index fa0a0e3..b8010f6 100644
--- a/core/fxge/win32/cfx_psrenderer.h
+++ b/core/fxge/win32/cfx_psrenderer.h
@@ -121,7 +121,7 @@
     ~FaxCompressResult();
 
     DataVector<uint8_t> data;
-    bool compressed;
+    bool compressed = false;
   };
 
   struct PSCompressResult {