diff options
| author | tsepez <tsepez@chromium.org> | 2017-01-24 09:31:33 -0800 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2017-01-24 09:31:33 -0800 |
| commit | 41c23536d10b04f56d0c4dfd1c36ee4664d9b7f9 (patch) | |
| tree | 8887036d22bde8c36827a2b8822deaa02773b368 | |
| parent | 8804940c9a394ff23d641a8cf2efd5300dc87f9e (diff) | |
| download | pdfium-41c23536d10b04f56d0c4dfd1c36ee4664d9b7f9.tar.xz | |
Undefined shift in CPDF_PSEngine::DoOperator
Also fix an unsafe negation in same block.
BUG=641551
BUG=681091
Review-Url: https://codereview.chromium.org/2649283002
| -rw-r--r-- | core/fpdfapi/page/fpdf_page_func.cpp | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/core/fpdfapi/page/fpdf_page_func.cpp b/core/fpdfapi/page/fpdf_page_func.cpp index 9949e052c9..916641f05d 100644 --- a/core/fpdfapi/page/fpdf_page_func.cpp +++ b/core/fpdfapi/page/fpdf_page_func.cpp @@ -410,12 +410,15 @@ bool CPDF_PSEngine::DoOperator(PDF_PSOP op) { break; case PSOP_BITSHIFT: { int shift = (int)Pop(); - int i = (int)Pop(); + result = (int)Pop(); if (shift > 0) { - Push(i << shift); + result <<= shift; } else { - Push(i >> -shift); + // Avoids unsafe negation of INT_MIN. + FX_SAFE_INT32 safe_shift = shift; + result >>= (-safe_shift).ValueOrDefault(0); } + Push(result.ValueOrDefault(0)); break; } case PSOP_TRUE: |