diff options
| author | Dan Sinclair <dsinclair@chromium.org> | 2018-05-16 14:09:15 +0000 |
|---|---|---|
| committer | Chromium commit bot <commit-bot@chromium.org> | 2018-05-16 14:09:15 +0000 |
| commit | 99a046acd2d1ce1f093937642b6a9165f8f41986 (patch) | |
| tree | 93c776fa79e4bd9f6e60cff3587b6e6053497c0c | |
| parent | a68ee04cfdeb39637a06764dcb924ac806dfdf95 (diff) | |
| download | pdfium-99a046acd2d1ce1f093937642b6a9165f8f41986.tar.xz | |
Use CheckedNumeric in CFX_RTFBreak::AppendChar_Others
This CL adds verification to the m_iWidth value when adding the
characters width.
Bug: chromium:843096
Change-Id: I7b2e7b1e786a9cba77f5aceafbb5d2bf13dc8eb9
Reviewed-on: https://pdfium-review.googlesource.com/32610
Reviewed-by: Ryan Harrison <rharrison@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>
| -rw-r--r-- | xfa/fgas/layout/cfx_rtfbreak.cpp | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/xfa/fgas/layout/cfx_rtfbreak.cpp b/xfa/fgas/layout/cfx_rtfbreak.cpp index 0eb7d63a3a..f7369bd11a 100644 --- a/xfa/fgas/layout/cfx_rtfbreak.cpp +++ b/xfa/fgas/layout/cfx_rtfbreak.cpp @@ -11,6 +11,7 @@ #include "core/fxcrt/fx_arabic.h" #include "core/fxcrt/fx_bidi.h" #include "core/fxge/cfx_renderdevice.h" +#include "third_party/base/numerics/safe_math.h" #include "third_party/base/stl_util.h" #include "xfa/fgas/font/cfgas_gefont.h" #include "xfa/fgas/layout/cfx_linebreak.h" @@ -254,7 +255,13 @@ CFX_BreakType CFX_RTFBreak::AppendChar_Others(CFX_Char* pCurChar) { int iCharWidthValid = iCharWidth.ValueOrDefault(0); pCurChar->m_iCharWidth = iCharWidthValid; - m_pCurLine->m_iWidth += iCharWidthValid; + + pdfium::base::CheckedNumeric<int32_t> checked_width = m_pCurLine->m_iWidth; + checked_width += iCharWidthValid; + if (!checked_width.IsValid()) + return CFX_BreakType::None; + + m_pCurLine->m_iWidth = checked_width.ValueOrDie(); if (chartype != FX_CHARTYPE_Space && m_pCurLine->GetLineEnd() > m_iLineWidth + m_iTolerance) { return EndBreak(CFX_BreakType::Line); |