summaryrefslogtreecommitdiff
path: root/core/fxge
diff options
context:
space:
mode:
authorHenrique Nakashima <hnakashima@chromium.org>2018-06-22 17:10:36 +0000
committerChromium commit bot <commit-bot@chromium.org>2018-06-22 17:10:36 +0000
commite6ca7c2d7d45bd59d53c3c6f9952e2001cf81890 (patch)
tree8b2db7c1a6a7c8bce469c26795d132d7519e8c37 /core/fxge
parent0a49103801e322656eeacf8764cc0cb557059cea (diff)
downloadpdfium-e6ca7c2d7d45bd59d53c3c6f9952e2001cf81890.tar.xz
Fix overflow in CFX_RenderDevice::DrawFillStrokePath().
Bug: chromium:853430 Change-Id: I1c42de1e3db10dfb6399cd8abdd13c56addc8827 Reviewed-on: https://pdfium-review.googlesource.com/35850 Reviewed-by: Tom Sepez <tsepez@chromium.org> Reviewed-by: Ryan Harrison <rharrison@chromium.org> Commit-Queue: Henrique Nakashima <hnakashima@chromium.org>
Diffstat (limited to 'core/fxge')
-rw-r--r--core/fxge/cfx_renderdevice.cpp11
1 files changed, 7 insertions, 4 deletions
diff --git a/core/fxge/cfx_renderdevice.cpp b/core/fxge/cfx_renderdevice.cpp
index c63f2f5ec3..16d723721f 100644
--- a/core/fxge/cfx_renderdevice.cpp
+++ b/core/fxge/cfx_renderdevice.cpp
@@ -632,21 +632,24 @@ bool CFX_RenderDevice::DrawFillStrokePath(const CFX_PathData* pPathData,
bbox = pObject2Device->TransformRect(bbox);
FX_RECT rect = bbox.GetOuterRect();
+ if (!rect.Valid())
+ return false;
+
auto bitmap = pdfium::MakeRetain<CFX_DIBitmap>();
- auto Backdrop = pdfium::MakeRetain<CFX_DIBitmap>();
+ auto backdrop = pdfium::MakeRetain<CFX_DIBitmap>();
if (!CreateCompatibleBitmap(bitmap, rect.Width(), rect.Height()))
return false;
if (bitmap->HasAlpha()) {
bitmap->Clear(0);
- Backdrop->Copy(bitmap);
+ backdrop->Copy(bitmap);
} else {
if (!m_pDeviceDriver->GetDIBits(bitmap, rect.left, rect.top))
return false;
- Backdrop->Copy(bitmap);
+ backdrop->Copy(bitmap);
}
CFX_DefaultRenderDevice bitmap_device;
- bitmap_device.Attach(bitmap, false, Backdrop, true);
+ bitmap_device.Attach(bitmap, false, backdrop, true);
CFX_Matrix matrix;
if (pObject2Device)