Remove FX_STRSIZE casts, use safe conversions

BUG=pdfium:153
R=thestig@chromium.org

Review URL: https://codereview.chromium.org/1124043003

2 files changed, 31 insertions, 17 deletions

diff --git a/core/include/fxcrt/fx_string.h b/core/include/fxcrt/fx_string.h
index fe0985772d..18cd997ee8 100644
--- a/core/include/fxcrt/fx_string.h
+++ b/core/include/fxcrt/fx_string.h
@@ -11,12 +11,12 @@
 #include <algorithm>
 
 #include "fx_memory.h"
+#include "fx_system.h"
 
 class CFX_BinaryBuf;
 class CFX_ByteString;
 class CFX_WideString;
 struct CFX_CharMap;
-typedef int FX_STRSIZE;
 
 // An immutable string with caller-provided storage which must outlive the
 // string itself.
@@ -40,7 +40,7 @@ public:
     CFX_ByteStringC(FX_LPCSTR ptr)
     {
         m_Ptr = (FX_LPCBYTE)ptr;
-        m_Length = ptr ? (FX_STRSIZE)FXSYS_strlen(ptr) : 0;
+        m_Length = ptr ? FXSYS_strlen(ptr) : 0;
     }
 
     // |ch| must be an lvalue that outlives the the CFX_ByteStringC. However,
@@ -59,11 +59,7 @@ public:
     CFX_ByteStringC(FX_LPCSTR ptr, FX_STRSIZE len)
     {
         m_Ptr = (FX_LPCBYTE)ptr;
-        if (len == -1) {
-            m_Length = (FX_STRSIZE)FXSYS_strlen(ptr);
-        } else {
-            m_Length = len;
-        }
+        m_Length = (len == -1) ? FXSYS_strlen(ptr) : len;
     }
 
     CFX_ByteStringC(const CFX_ByteStringC& src)
@@ -77,7 +73,7 @@ public:
     CFX_ByteStringC& operator = (FX_LPCSTR src)
     {
         m_Ptr = (FX_LPCBYTE)src;
-        m_Length = m_Ptr ? (FX_STRSIZE)FXSYS_strlen(src) : 0;
+        m_Length = m_Ptr ? FXSYS_strlen(src) : 0;
         return *this;
     }
 
@@ -466,7 +462,7 @@ public:
     CFX_WideStringC(FX_LPCWSTR ptr)
     {
         m_Ptr = ptr;
-        m_Length = ptr ? (FX_STRSIZE)FXSYS_wcslen(ptr) : 0;
+        m_Length = ptr ? FXSYS_wcslen(ptr) : 0;
     }
 
     CFX_WideStringC(FX_WCHAR& ch)
@@ -478,11 +474,7 @@ public:
     CFX_WideStringC(FX_LPCWSTR ptr, FX_STRSIZE len)
     {
         m_Ptr = ptr;
-        if (len == -1) {
-            m_Length = (FX_STRSIZE)FXSYS_wcslen(ptr);
-        } else {
-            m_Length = len;
-        }
+        m_Length = (len == -1) ? FXSYS_wcslen(ptr) : len;
     }
 
     CFX_WideStringC(const CFX_WideStringC& src)
@@ -496,7 +488,7 @@ public:
     CFX_WideStringC& operator = (FX_LPCWSTR src)
     {
         m_Ptr = src;
-        m_Length = (FX_STRSIZE)FXSYS_wcslen(src);
+        m_Length = FXSYS_wcslen(src);
         return *this;
     }
 
diff --git a/core/include/fxcrt/fx_system.h b/core/include/fxcrt/fx_system.h
index ce86d5ad5c..50d3344a89 100644
--- a/core/include/fxcrt/fx_system.h
+++ b/core/include/fxcrt/fx_system.h
@@ -14,6 +14,7 @@
 #define _FXM_PLATFORM_LINUX_		2
 #define _FXM_PLATFORM_APPLE_		3
 #define _FXM_PLATFORM_ANDROID_		4
+
 #ifndef _FX_OS_
 #if defined(__ANDROID__)
 #define _FX_OS_ _FX_ANDROID_
@@ -29,9 +30,11 @@
 #define _FXM_PLATFORM_ _FXM_PLATFORM_APPLE_
 #endif
 #endif
+
 #if !defined(_FX_OS_) || _FX_OS_ == 0
 #error Sorry, can not figure out what OS you are targeting to. Please specify _FX_OS_ macro.
 #endif
+
 #if _FXM_PLATFORM_ == _FXM_PLATFORM_WINDOWS_
 #define _CRT_SECURE_NO_WARNINGS
 #include <sal.h>
@@ -46,6 +49,7 @@
 #define _FX_WORDSIZE_	_FX_W32_
 #endif
 #endif
+
 #include <stddef.h>
 #include <stdarg.h>
 #include <setjmp.h>
@@ -54,6 +58,7 @@
 #include <string.h>
 #include <assert.h>
 #include <wchar.h>
+
 #if _FXM_PLATFORM_ == _FXM_PLATFORM_APPLE_
 #include <libkern/OSAtomic.h>
 #if _FX_OS_ == _FX_MACOSX_
@@ -63,6 +68,7 @@
 #include <CoreGraphics/CoreGraphics.h>
 #endif
 #endif
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -110,6 +116,12 @@ typedef wchar_t*				FX_LPWSTR;
 typedef wchar_t const*			FX_LPCWSTR;
 typedef FX_DWORD				FX_UINT32;
 typedef FX_UINT64				FX_QWORD;
+
+// PDFium string sizes are limited to 2^31-1, and the value is signed to
+// allow -1 as a placeholder for "unknown".
+// TODO(palmer): it should be a |size_t|, or at least unsigned.
+typedef int FX_STRSIZE;
+
 #if defined(DEBUG) && !defined(_DEBUG)
 #define _DEBUG
 #endif
@@ -152,7 +164,6 @@ void FXSYS_vsnprintf(char *str, size_t size, const char* fmt, va_list ap);
 #define FXSYS_sprintf	DO_NOT_USE_SPRINTF_DIE_DIE_DIE
 #define FXSYS_vsprintf	DO_NOT_USE_VSPRINTF_DIE_DIE_DIE
 #define FXSYS_strchr	strchr
-#define FXSYS_strlen	strlen
 #define FXSYS_strncmp	strncmp
 #define FXSYS_strcmp	strcmp
 #define FXSYS_strcpy	strcpy
@@ -169,6 +180,7 @@ void FXSYS_vsnprintf(char *str, size_t size, const char* fmt, va_list ap);
 #define FXSYS_fwrite	fwrite
 #define FXSYS_fprintf	fprintf
 #define FXSYS_fflush	fflush
+
 #if _FXM_PLATFORM_ == _FXM_PLATFORM_WINDOWS_
 #ifdef _NATIVE_WCHAR_T_DEFINED
 #define FXSYS_wfopen(f, m) _wfopen((const wchar_t*)(f), (const wchar_t*)(m))
@@ -179,7 +191,17 @@ void FXSYS_vsnprintf(char *str, size_t size, const char* fmt, va_list ap);
 FXSYS_FILE* FXSYS_wfopen(FX_LPCWSTR filename, FX_LPCWSTR mode);
 #endif
 
-#define FXSYS_wcslen	wcslen
+#ifdef __cplusplus
+} // extern "C"
+#include "../../../third_party/base/numerics/safe_conversions.h"
+#define FXSYS_strlen(ptr) pdfium::base::checked_cast<FX_STRSIZE>(strlen(ptr))
+#define FXSYS_wcslen(ptr) pdfium::base::checked_cast<FX_STRSIZE>(wcslen(ptr))
+extern "C" {
+#else
+#define FXSYS_strlen(ptr) ((FX_STRSIZE)strlen(ptr))
+#define FXSYS_wcslen(ptr) ((FX_STRSIZE)wcslen(ptr))
+#endif
+
 #define FXSYS_wcscmp	wcscmp
 #define FXSYS_wcschr	wcschr
 #define FXSYS_wcsstr	wcsstr