diff options
| author | Oliver Chang <ochang@chromium.org> | 2015-11-10 14:11:52 -0800 |
|---|---|---|
| committer | Oliver Chang <ochang@chromium.org> | 2015-11-10 14:11:52 -0800 |
| commit | 46d2e278f62454ed2392630b6d18d33d380a20eb (patch) | |
| tree | 0c090c69283954215e8741ed805f1f6c19972897 | |
| parent | 16f26fb7621c8ee554f4d7c5b4c1972eb0ed7065 (diff) | |
| download | pdfium-46d2e278f62454ed2392630b6d18d33d380a20eb.tar.xz | |
Prevent buffer underflow in CPDF_TextObject::CalcPositionData
R=tsepez@chromium.org
BUG=554115
Review URL: https://codereview.chromium.org/1435473004 .
| -rw-r--r-- | core/src/fpdfapi/fpdf_page/fpdf_page.cpp | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/core/src/fpdfapi/fpdf_page/fpdf_page.cpp b/core/src/fpdfapi/fpdf_page/fpdf_page.cpp index eaa8ef1127..3777cd078c 100644 --- a/core/src/fpdfapi/fpdf_page/fpdf_page.cpp +++ b/core/src/fpdfapi/fpdf_page/fpdf_page.cpp @@ -409,11 +409,11 @@ void CPDF_TextObject::CalcPositionData(FX_FLOAT* pTextAdvanceX, for (int i = 0; i < m_nChars; ++i) { FX_DWORD charcode = m_nChars == 1 ? (FX_DWORD)(uintptr_t)m_pCharCodes : m_pCharCodes[i]; - if (charcode == (FX_DWORD)-1) { - curpos -= FXSYS_Mul(m_pCharPos[i - 1], fontsize) / 1000; - continue; - } - if (i) { + if (i > 0) { + if (charcode == (FX_DWORD)-1) { + curpos -= FXSYS_Mul(m_pCharPos[i - 1], fontsize) / 1000; + continue; + } m_pCharPos[i - 1] = curpos; } FX_RECT char_rect; |