Fix a crasher in CXFA_ItemLayoutProcessor::DoLayoutTableContainer()

BUG=pdfium:408
R=tsepez@chromium.org

Review URL: https://codereview.chromium.org/1719863002 .

1 files changed, 7 insertions, 6 deletions

diff --git a/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp b/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp
index ed0836d539..071fe4d40f 100644
--- a/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp
+++ b/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp
@@ -1521,15 +1521,16 @@ void CXFA_ItemLayoutProcessor::DoLayoutTableContainer(CXFA_Node* pLayoutNode) {
         }
       }
       if (bMoreColumns) {
-        FX_FLOAT fFinalColumnWidth = m_rgSpecifiedColumnWidths[iColCount];
-        for (int32_t i = 0; i < iRowCount; i++) {
-          if (!rgRowItems[i]) {
+        FX_FLOAT fFinalColumnWidth = 0.0f;
+        if (iColCount < m_rgSpecifiedColumnWidths.GetSize())
+          fFinalColumnWidth = m_rgSpecifiedColumnWidths[iColCount];
+        for (int32_t i = 0; i < iRowCount; ++i) {
+          if (!rgRowItems[i])
             continue;
-          }
-          rgRowItemsSpan[i]--;
+          --rgRowItemsSpan[i];
           rgRowItemsWidth[i] -= fFinalColumnWidth;
         }
-        iColCount++;
+        ++iColCount;
       }
     }
   }