VULNERABILITY DETAILS
The attached pdf file could crash PDFium when XFA and ASAN was enabled on Windows.

```
is_asan = true
pdf_enable_xfa = true
pdf_enable_v8 = true
```

The following error log was produced by AddressSanitizer.
```
=================================================================
==8184==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x07b0d881 at pc 0x03132463 bp 0x0031cc58 sp 0x0031cc4c
READ of size 1 at 0x07b0d881 thread T0
==8184==*** WARNING: Failed to initialize DbgHelp!              ***
==8184==*** Most likely this means that the app is already      ***
==8184==*** using DbgHelp, possibly with incompatible flags.    ***
==8184==*** Due to technical reasons, symbolization might crash ***
==8184==*** or produce wrong results.                           ***
    #0 0x3132462 in BMPDecompressor::ReadHeader C:\pdfium\core\fxcodec\lbmp\fx_bmp.cpp:101
    #1 0x3122ef2 in CCodec_BmpModule::ReadHeader C:\pdfium\core\fxcodec\codec\ccodec_bmpmodule.cpp:46
    #2 0x3bcc0e5 in CCodec_ProgressiveDecoder::BmpDetectImageType C:\pdfium\core\fxcodec\codec\fx_codec_progress.cpp:1043
    #3 0x3bcbc1b in CCodec_ProgressiveDecoder::DetectImageType C:\pdfium\core\fxcodec\codec\fx_codec_progress.cpp:1006
    #4 0x3bcf590 in CCodec_ProgressiveDecoder::LoadImageInfo C:\pdfium\core\fxcodec\codec\fx_codec_progress.cpp:1303
    #5 0x38b5bbc in XFA_LoadImageFromBuffer C:\pdfium\xfa\fxfa\cxfa_ffwidget.cpp:159
    #6 0x394895a in `anonymous namespace'::XFA_LoadImageData C:\pdfium\xfa\fxfa\parser\cxfa_node.cpp:226
    #7 0x392cdf6 in CXFA_Node::LoadImageImage C:\pdfium\xfa\fxfa\parser\cxfa_node.cpp:3002
    #8 0x38d866d in CXFA_FFImage::LoadWidget C:\pdfium\xfa\fxfa\cxfa_ffimage.cpp:32
    #9 0x38a122e in CXFA_FFPageWidgetIterator::GetWidget C:\pdfium\xfa\fxfa\cxfa_ffpageview.cpp:214
    #10 0x38a152d in CXFA_FFPageWidgetIterator::MoveToNext C:\pdfium\xfa\fxfa\cxfa_ffpageview.cpp:177
    #11 0x2e4cedc in CPDFSDK_PageView::LoadFXAnnots C:\pdfium\fpdfsdk\cpdfsdk_pageview.cpp:439
    #12 0x2e3db97 in CPDFSDK_FormFillEnvironment::GetPageView C:\pdfium\fpdfsdk\cpdfsdk_formfillenvironment.cpp:562
    #13 0x2e2fa97 in `anonymous namespace'::FormHandleToPageView C:\pdfium\fpdfsdk\fpdfformfill.cpp:120
    #14 0x2e30c16 in FORM_OnAfterLoadPage C:\pdfium\fpdfsdk\fpdfformfill.cpp:746
    #15 0x12b16ed in `anonymous namespace'::GetPageForIndex C:\pdfium\samples\pdfium_test.cc:995
    #16 0x12b1aec in `anonymous namespace'::RenderPage C:\pdfium\samples\pdfium_test.cc:1234
    #17 0x1294907 in main C:\pdfium\samples\pdfium_test.cc:1630
    #18 0x3e787aa in __scrt_common_main_seh f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:283
    #19 0x75ad3369 in BaseThreadInitThunk+0x11 (C:\Windows\syswow64\kernel32.dll+0x7dd73369)
    #20 0x774898f1 in RtlInitializeExceptionChain+0x62 (C:\Windows\SysWOW64\ntdll.dll+0x7dea98f1)
    #21 0x774898c4 in RtlInitializeExceptionChain+0x35 (C:\Windows\SysWOW64\ntdll.dll+0x7dea98c4)

0x07b0d881 is located 3 bytes to the right of 14-byte region [0x07b0d870,0x07b0d87e)
allocated by thread T0 here:
    #0 0x3e654ac in malloc c:\b\rr\tmp8oruyi\w\src\third_party\llvm\projects\compiler-rt\lib\asan\asan_malloc_win.cc:60
    #1 0x3bcbba9 in CCodec_ProgressiveDecoder::DetectImageType C:\pdfium\core\fxcodec\codec\fx_codec_progress.cpp:1000
    #2 0x3bcf590 in CCodec_ProgressiveDecoder::LoadImageInfo C:\pdfium\core\fxcodec\codec\fx_codec_progress.cpp:1303
    #3 0x38b5bbc in XFA_LoadImageFromBuffer C:\pdfium\xfa\fxfa\cxfa_ffwidget.cpp:159
    #4 0x394895a in `anonymous namespace'::XFA_LoadImageData C:\pdfium\xfa\fxfa\parser\cxfa_node.cpp:226
    #5 0x392cdf6 in CXFA_Node::LoadImageImage C:\pdfium\xfa\fxfa\parser\cxfa_node.cpp:3002
    #6 0x38d866d in CXFA_FFImage::LoadWidget C:\pdfium\xfa\fxfa\cxfa_ffimage.cpp:32
    #7 0x38a122e in CXFA_FFPageWidgetIterator::GetWidget C:\pdfium\xfa\fxfa\cxfa_ffpageview.cpp:214
    #8 0x38a152d in CXFA_FFPageWidgetIterator::MoveToNext C:\pdfium\xfa\fxfa\cxfa_ffpageview.cpp:177
    #9 0x2e4cedc in CPDFSDK_PageView::LoadFXAnnots C:\pdfium\fpdfsdk\cpdfsdk_pageview.cpp:439
    #10 0x2e3db97 in CPDFSDK_FormFillEnvironment::GetPageView C:\pdfium\fpdfsdk\cpdfsdk_formfillenvironment.cpp:562
    #11 0x2e2fa97 in `anonymous namespace'::FormHandleToPageView C:\pdfium\fpdfsdk\fpdfformfill.cpp:120
    #12 0x2e30c16 in FORM_OnAfterLoadPage C:\pdfium\fpdfsdk\fpdfformfill.cpp:746
    #13 0x12b16ed in `anonymous namespace'::GetPageForIndex C:\pdfium\samples\pdfium_test.cc:995
    #14 0x12b1aec in `anonymous namespace'::RenderPage C:\pdfium\samples\pdfium_test.cc:1234
    #15 0x1294907 in main C:\pdfium\samples\pdfium_test.cc:1630
    #16 0x3e787aa in __scrt_common_main_seh f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:283
    #17 0x75ad3369 in BaseThreadInitThunk+0x11 (C:\Windows\syswow64\kernel32.dll+0x7dd73369)
    #18 0x774898f1 in RtlInitializeExceptionChain+0x62 (C:\Windows\SysWOW64\ntdll.dll+0x7dea98f1)
    #19 0x774898c4 in RtlInitializeExceptionChain+0x35 (C:\Windows\SysWOW64\ntdll.dll+0x7dea98c4)

SUMMARY: AddressSanitizer: heap-buffer-overflow C:\pdfium\core\fxcodec\lbmp\fx_bmp.cpp:101 in BMPDecompressor::ReadHeader
Shadow bytes around the buggy address:
  0x30f61ac0: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa
  0x30f61ad0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x30f61ae0: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fd
  0x30f61af0: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x30f61b00: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 00 06
=>0x30f61b10:[fa]fa 04 fa fa fa fd fd fa fa fd fd fa fa fd fa
  0x30f61b20: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x30f61b30: fa fa fd fd fa fa fd fa fa fa fd fa fa fa fd fa
  0x30f61b40: fa fa fd fa fa fa fd fa fa fa fd fd fa fa fd fd
  0x30f61b50: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x30f61b60: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==8184==ABORTING
```

VERSION
Chrome Version: PDFium with JS / XFA / ASAN enabled.
Operating System: Windows

REPRODUCTION CASE
Please include a demonstration of the security bug, such as an attached
HTML or binary file that reproduces the bug when loaded in Chrome. PLEASE
make the file as small as possible and remove any content not required to
demonstrate the bug.

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [tab, browser, etc.]
Crash State: [see link above: stack trace *with symbols*, registers,
exception record]
Client ID (if relevant): [see link above]