VULNERABILITY DETAILS
The attached pdf file could crash PDFium when XFA and ASAN was enabled on Windows.

```
is_asan = true
pdf_enable_xfa = true
pdf_enable_v8 = true
```

The following error log was produced by AddressSanitizer.
```
=================================================================
==11204==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x07947489 at pc 0x03251e14 bp 0x002fc7f8 sp 0x002fc7ec
READ of size 1 at 0x07947489 thread T0
==11204==*** WARNING: Failed to initialize DbgHelp!              ***
==11204==*** Most likely this means that the app is already      ***
==11204==*** using DbgHelp, possibly with incompatible flags.    ***
==11204==*** Due to technical reasons, symbolization might crash ***
==11204==*** or produce wrong results.                           ***
    #0 0x3251e13 in CFX_BmpDecompressor::ReadHeader C:\pdfium\core\fxcodec\bmp\cfx_bmpdecompressor.cpp:159
    #1 0x3241f82 in CCodec_BmpModule::ReadHeader C:\pdfium\core\fxcodec\codec\ccodec_bmpmodule.cpp:39
    #2 0x3ce8df5 in CCodec_ProgressiveDecoder::BmpDetectImageType C:\pdfium\core\fxcodec\codec\fx_codec_progress.cpp:1043
    #3 0x3ce892b in CCodec_ProgressiveDecoder::DetectImageType C:\pdfium\core\fxcodec\codec\fx_codec_progress.cpp:1006
    #4 0x3cec2a0 in CCodec_ProgressiveDecoder::LoadImageInfo C:\pdfium\core\fxcodec\codec\fx_codec_progress.cpp:1303
    #5 0x39d249c in XFA_LoadImageFromBuffer C:\pdfium\xfa\fxfa\cxfa_ffwidget.cpp:159
    #6 0x3a6546a in `anonymous namespace'::XFA_LoadImageData C:\pdfium\xfa\fxfa\parser\cxfa_node.cpp:226
    #7 0x3a498f6 in CXFA_Node::LoadImageImage C:\pdfium\xfa\fxfa\parser\cxfa_node.cpp:3000
    #8 0x39f4f7d in CXFA_FFImage::LoadWidget C:\pdfium\xfa\fxfa\cxfa_ffimage.cpp:32
    #9 0x39bdc5e in CXFA_FFPageWidgetIterator::GetWidget C:\pdfium\xfa\fxfa\cxfa_ffpageview.cpp:214
    #10 0x39bdf5d in CXFA_FFPageWidgetIterator::MoveToNext C:\pdfium\xfa\fxfa\cxfa_ffpageview.cpp:177
    #11 0x2f6d0ac in CPDFSDK_PageView::LoadFXAnnots C:\pdfium\fpdfsdk\cpdfsdk_pageview.cpp:439
    #12 0x2f5da67 in CPDFSDK_FormFillEnvironment::GetPageView C:\pdfium\fpdfsdk\cpdfsdk_formfillenvironment.cpp:562
    #13 0x2f4fd57 in `anonymous namespace'::FormHandleToPageView C:\pdfium\fpdfsdk\fpdfformfill.cpp:120
    #14 0x2f50ed6 in FORM_OnAfterLoadPage C:\pdfium\fpdfsdk\fpdfformfill.cpp:746
    #15 0x13d17d6 in `anonymous namespace'::GetPageForIndex C:\pdfium\samples\pdfium_test.cc:999
    #16 0x13d1c2c in `anonymous namespace'::RenderPage C:\pdfium\samples\pdfium_test.cc:1237
    #17 0x13b491f in main C:\pdfium\samples\pdfium_test.cc:1633
    #18 0x3f974fa in __scrt_common_main_seh f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:283
    #19 0x75ad3369 in BaseThreadInitThunk+0x11 (C:\Windows\syswow64\kernel32.dll+0x7dd73369)
    #20 0x774898f1 in RtlInitializeExceptionChain+0x62 (C:\Windows\SysWOW64\ntdll.dll+0x7dea98f1)
    #21 0x774898c4 in RtlInitializeExceptionChain+0x35 (C:\Windows\SysWOW64\ntdll.dll+0x7dea98c4)

0x07947489 is located 3 bytes to the right of 22-byte region [0x07947470,0x07947486)
allocated by thread T0 here:
    #0 0x3f842bc in malloc c:\b\rr\tmp8oruyi\w\src\third_party\llvm\projects\compiler-rt\lib\asan\asan_malloc_win.cc:60
    #1 0x3ce88b9 in CCodec_ProgressiveDecoder::DetectImageType C:\pdfium\core\fxcodec\codec\fx_codec_progress.cpp:1000
    #2 0x3cec2a0 in CCodec_ProgressiveDecoder::LoadImageInfo C:\pdfium\core\fxcodec\codec\fx_codec_progress.cpp:1303
    #3 0x39d249c in XFA_LoadImageFromBuffer C:\pdfium\xfa\fxfa\cxfa_ffwidget.cpp:159
    #4 0x3a6546a in `anonymous namespace'::XFA_LoadImageData C:\pdfium\xfa\fxfa\parser\cxfa_node.cpp:226
    #5 0x3a498f6 in CXFA_Node::LoadImageImage C:\pdfium\xfa\fxfa\parser\cxfa_node.cpp:3000
    #6 0x39f4f7d in CXFA_FFImage::LoadWidget C:\pdfium\xfa\fxfa\cxfa_ffimage.cpp:32
    #7 0x39bdc5e in CXFA_FFPageWidgetIterator::GetWidget C:\pdfium\xfa\fxfa\cxfa_ffpageview.cpp:214
    #8 0x39bdf5d in CXFA_FFPageWidgetIterator::MoveToNext C:\pdfium\xfa\fxfa\cxfa_ffpageview.cpp:177
    #9 0x2f6d0ac in CPDFSDK_PageView::LoadFXAnnots C:\pdfium\fpdfsdk\cpdfsdk_pageview.cpp:439
    #10 0x2f5da67 in CPDFSDK_FormFillEnvironment::GetPageView C:\pdfium\fpdfsdk\cpdfsdk_formfillenvironment.cpp:562
    #11 0x2f4fd57 in `anonymous namespace'::FormHandleToPageView C:\pdfium\fpdfsdk\fpdfformfill.cpp:120
    #12 0x2f50ed6 in FORM_OnAfterLoadPage C:\pdfium\fpdfsdk\fpdfformfill.cpp:746
    #13 0x13d17d6 in `anonymous namespace'::GetPageForIndex C:\pdfium\samples\pdfium_test.cc:999
    #14 0x13d1c2c in `anonymous namespace'::RenderPage C:\pdfium\samples\pdfium_test.cc:1237
    #15 0x13b491f in main C:\pdfium\samples\pdfium_test.cc:1633
    #16 0x3f974fa in __scrt_common_main_seh f:\dd\vctools\crt\vcstartup\src\startup\exe_common.inl:283
    #17 0x75ad3369 in BaseThreadInitThunk+0x11 (C:\Windows\syswow64\kernel32.dll+0x7dd73369)
    #18 0x774898f1 in RtlInitializeExceptionChain+0x62 (C:\Windows\SysWOW64\ntdll.dll+0x7dea98f1)
    #19 0x774898c4 in RtlInitializeExceptionChain+0x35 (C:\Windows\SysWOW64\ntdll.dll+0x7dea98c4)

SUMMARY: AddressSanitizer: heap-buffer-overflow C:\pdfium\core\fxcodec\bmp\cfx_bmpdecompressor.cpp:159 in CFX_BmpDecompressor::ReadHeader
Shadow bytes around the buggy address:
  0x30f28e40: 00 00 00 00 fa fa fd fd fd fa fa fa 00 00 00 fa
  0x30f28e50: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00
  0x30f28e60: 00 00 fa fa 00 00 00 fa fa fa fd fd fd fa fa fa
  0x30f28e70: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fa
  0x30f28e80: fa fa fd fd fd fd fa fa 00 00 00 04 fa fa 00 00
=>0x30f28e90: 06[fa]fa fa 00 00 00 fa fa fa 00 00 00 00 fa fa
  0x30f28ea0: fd fd fd fd fa fa fd fd fd fa fa fa fd fd fd fd
  0x30f28eb0: fa fa fd fd fd fd fa fa 00 00 00 04 fa fa 00 00
  0x30f28ec0: 00 fa fa fa 00 00 04 fa fa fa 00 00 00 fa fa fa
  0x30f28ed0: 00 00 00 fa fa fa 00 00 00 fa fa fa fd fd fd fa
  0x30f28ee0: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==11204==ABORTING
```

VERSION
Chrome Version: PDFium with JS / XFA / ASAN enabled.
Operating System: Windows

REPRODUCTION CASE
Please include a demonstration of the security bug, such as an attached
HTML or binary file that reproduces the bug when loaded in Chrome. PLEASE
make the file as small as possible and remove any content not required to
demonstrate the bug.

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [tab, browser, etc.]
Crash State: [see link above: stack trace *with symbols*, registers,
exception record]
Client ID (if relevant): [see link above]