diff options
| author | Bo Xu <bo_xu@foxitsoftware.com> | 2014-07-31 09:55:36 -0700 |
|---|---|---|
| committer | Bo Xu <bo_xu@foxitsoftware.com> | 2014-07-31 09:55:36 -0700 |
| commit | 2fd400c319c68b4b8bd741c0df51c8846c40a276 (patch) | |
| tree | 4ad54aae90cccff87be7107afa06f3ce28d1e481 /core/src/fxge | |
| parent | 10ec7ca17e7ec9aa68fd051c5fe5a6c75092dd79 (diff) | |
| download | pdfium-2fd400c319c68b4b8bd741c0df51c8846c40a276.tar.xz | |
Fix integer overflow when stretch bitmap
When an image object is zoomed in by a big factor, the scaling factor in the transformation matrix is big as well, resulting in a large |dest_width| and |dest_height| value(they can be think of as the equivalent pixel size of the entire image, although most of it is outside the device).
BUG=395636
R=vitalybuka@chromium.org
Review URL: https://codereview.chromium.org/432543002
Diffstat (limited to 'core/src/fxge')
| -rw-r--r-- | core/src/fxge/win32/fx_win32_device.cpp | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/core/src/fxge/win32/fx_win32_device.cpp b/core/src/fxge/win32/fx_win32_device.cpp index 154bbc407c..5e76898db1 100644 --- a/core/src/fxge/win32/fx_win32_device.cpp +++ b/core/src/fxge/win32/fx_win32_device.cpp @@ -523,7 +523,7 @@ FX_BOOL CGdiDeviceDriver::GDI_StretchDIBits(const CFX_DIBitmap* pBitmap1, int de return FALSE; } CFX_ByteString info = CFX_WindowsDIB::GetBitmapInfo(pBitmap); - if (abs(dest_width) * abs(dest_height) < pBitmap1->GetWidth() * pBitmap1->GetHeight() * 4 || + if ((FX_INT64)abs(dest_width) * abs(dest_height) < (FX_INT64)pBitmap1->GetWidth() * pBitmap1->GetHeight() * 4 || (flags & FXDIB_INTERPOL) || (flags & FXDIB_BICUBIC_INTERPOL)) { SetStretchBltMode(m_hDC, HALFTONE); } else { @@ -531,7 +531,7 @@ FX_BOOL CGdiDeviceDriver::GDI_StretchDIBits(const CFX_DIBitmap* pBitmap1, int de } CFX_DIBitmap* pToStrechBitmap = pBitmap; bool del = false; - if (m_DeviceClass == FXDC_PRINTER && (pBitmap->GetWidth() * pBitmap->GetHeight() > abs(dest_width) * abs(dest_height))) { + if (m_DeviceClass == FXDC_PRINTER && ((FX_INT64)pBitmap->GetWidth() * pBitmap->GetHeight() > (FX_INT64)abs(dest_width) * abs(dest_height))) { pToStrechBitmap = pBitmap->StretchTo(dest_width, dest_height); del = true; } |