summaryrefslogtreecommitdiff
path: root/core/src/fxge
diff options
context:
space:
mode:
authorBo Xu <bo_xu@foxitsoftware.com>2014-07-31 09:55:36 -0700
committerBo Xu <bo_xu@foxitsoftware.com>2014-07-31 09:55:36 -0700
commit2fd400c319c68b4b8bd741c0df51c8846c40a276 (patch)
tree4ad54aae90cccff87be7107afa06f3ce28d1e481 /core/src/fxge
parent10ec7ca17e7ec9aa68fd051c5fe5a6c75092dd79 (diff)
downloadpdfium-2fd400c319c68b4b8bd741c0df51c8846c40a276.tar.xz
Fix integer overflow when stretch bitmap
When an image object is zoomed in by a big factor, the scaling factor in the transformation matrix is big as well, resulting in a large |dest_width| and |dest_height| value(they can be think of as the equivalent pixel size of the entire image, although most of it is outside the device). BUG=395636 R=vitalybuka@chromium.org Review URL: https://codereview.chromium.org/432543002
Diffstat (limited to 'core/src/fxge')
-rw-r--r--core/src/fxge/win32/fx_win32_device.cpp4
1 files changed, 2 insertions, 2 deletions
diff --git a/core/src/fxge/win32/fx_win32_device.cpp b/core/src/fxge/win32/fx_win32_device.cpp
index 154bbc407c..5e76898db1 100644
--- a/core/src/fxge/win32/fx_win32_device.cpp
+++ b/core/src/fxge/win32/fx_win32_device.cpp
@@ -523,7 +523,7 @@ FX_BOOL CGdiDeviceDriver::GDI_StretchDIBits(const CFX_DIBitmap* pBitmap1, int de
return FALSE;
}
CFX_ByteString info = CFX_WindowsDIB::GetBitmapInfo(pBitmap);
- if (abs(dest_width) * abs(dest_height) < pBitmap1->GetWidth() * pBitmap1->GetHeight() * 4 ||
+ if ((FX_INT64)abs(dest_width) * abs(dest_height) < (FX_INT64)pBitmap1->GetWidth() * pBitmap1->GetHeight() * 4 ||
(flags & FXDIB_INTERPOL) || (flags & FXDIB_BICUBIC_INTERPOL)) {
SetStretchBltMode(m_hDC, HALFTONE);
} else {
@@ -531,7 +531,7 @@ FX_BOOL CGdiDeviceDriver::GDI_StretchDIBits(const CFX_DIBitmap* pBitmap1, int de
}
CFX_DIBitmap* pToStrechBitmap = pBitmap;
bool del = false;
- if (m_DeviceClass == FXDC_PRINTER && (pBitmap->GetWidth() * pBitmap->GetHeight() > abs(dest_width) * abs(dest_height))) {
+ if (m_DeviceClass == FXDC_PRINTER && ((FX_INT64)pBitmap->GetWidth() * pBitmap->GetHeight() > (FX_INT64)abs(dest_width) * abs(dest_height))) {
pToStrechBitmap = pBitmap->StretchTo(dest_width, dest_height);
del = true;
}