commit 131c0eb2e34ece6ede6288842cb3004ec3c600d4
author Lei Zhang <thestig@chromium.org> Fri Sep 08 15:38:21 2017 -0700
committer Chromium commit bot <commit-bot@chromium.org> Fri Sep 08 22:51:02 2017 +0000
tree 383145ce921ee64e71d8dc949e36c7b4e9590e65
parent ee1e757902d0096cc482c74d4fc0e568e0b18541

Fix an off by 1 error in TIFF_PredictLine().

BUG=chromium:762106

Change-Id: I714d69320cc4fb81d535f811c18d4ef91fec44d3
Reviewed-on: https://pdfium-review.googlesource.com/13212
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Tom Sepez <tsepez@chromium.org>

core/fxcodec/codec/fx_codec_flate.cpp

diff --git a/core/fxcodec/codec/fx_codec_flate.cpp b/core/fxcodec/codec/fx_codec_flate.cpp
index 02be295..6482d52 100644
--- a/core/fxcodec/codec/fx_codec_flate.cpp
+++ b/core/fxcodec/codec/fx_codec_flate.cpp
@@ -472,7 +472,7 @@
   }
   int BytesPerPixel = BitsPerComponent * Colors / 8;
   if (BitsPerComponent == 16) {
-    for (uint32_t i = BytesPerPixel; i < row_size; i += 2) {
+    for (uint32_t i = BytesPerPixel; i + 1 < row_size; i += 2) {
       uint16_t pixel =
           (dest_buf[i - BytesPerPixel] << 8) | dest_buf[i - BytesPerPixel + 1];
       pixel += (dest_buf[i] << 8) | dest_buf[i + 1];