summaryrefslogtreecommitdiff
path: root/core/fpdfapi
diff options
context:
space:
mode:
authortsepez <tsepez@chromium.org>2017-01-24 09:31:33 -0800
committerCommit bot <commit-bot@chromium.org>2017-01-24 09:31:33 -0800
commit41c23536d10b04f56d0c4dfd1c36ee4664d9b7f9 (patch)
tree8887036d22bde8c36827a2b8822deaa02773b368 /core/fpdfapi
parent8804940c9a394ff23d641a8cf2efd5300dc87f9e (diff)
downloadpdfium-41c23536d10b04f56d0c4dfd1c36ee4664d9b7f9.tar.xz
Undefined shift in CPDF_PSEngine::DoOperator
Also fix an unsafe negation in same block. BUG=641551 BUG=681091 Review-Url: https://codereview.chromium.org/2649283002
Diffstat (limited to 'core/fpdfapi')
-rw-r--r--core/fpdfapi/page/fpdf_page_func.cpp9
1 files changed, 6 insertions, 3 deletions
diff --git a/core/fpdfapi/page/fpdf_page_func.cpp b/core/fpdfapi/page/fpdf_page_func.cpp
index 9949e052c9..916641f05d 100644
--- a/core/fpdfapi/page/fpdf_page_func.cpp
+++ b/core/fpdfapi/page/fpdf_page_func.cpp
@@ -410,12 +410,15 @@ bool CPDF_PSEngine::DoOperator(PDF_PSOP op) {
break;
case PSOP_BITSHIFT: {
int shift = (int)Pop();
- int i = (int)Pop();
+ result = (int)Pop();
if (shift > 0) {
- Push(i << shift);
+ result <<= shift;
} else {
- Push(i >> -shift);
+ // Avoids unsafe negation of INT_MIN.
+ FX_SAFE_INT32 safe_shift = shift;
+ result >>= (-safe_shift).ValueOrDefault(0);
}
+ Push(result.ValueOrDefault(0));
break;
}
case PSOP_TRUE: