diff options
| author | Dan Sinclair <dsinclair@chromium.org> | 2018-05-25 16:08:29 +0000 |
|---|---|---|
| committer | Chromium commit bot <commit-bot@chromium.org> | 2018-05-25 16:08:29 +0000 |
| commit | a2bb072a69b29695242a81e4b75c19c14c39acfb (patch) | |
| tree | d9eac05e30bd44d2daee9126fe37cb4e321f22c8 /fxjs/xfa/cjx_eventpseudomodel.cpp | |
| parent | da060ba107fba8ef679393b5622b6de2f4790379 (diff) | |
| download | pdfium-a2bb072a69b29695242a81e4b75c19c14c39acfb.tar.xz | |
[xfa] Clamp selStart, selEnd values in CJX_EventPseudoModel
This CL adds bounds checking for the selStart and selEnd settings of the
event object. The selEnd is not allowed to be less then selStart. They
are also not allowed to be negative. This also clamps them to the length
of the prevText string.
Bug: 1066
Change-Id: Ifc9113c669c83a4a97655554affbbce30c2bfc64
Reviewed-on: https://pdfium-review.googlesource.com/32933
Commit-Queue: Ryan Harrison <rharrison@chromium.org>
Reviewed-by: Ryan Harrison <rharrison@chromium.org>
Diffstat (limited to 'fxjs/xfa/cjx_eventpseudomodel.cpp')
| -rw-r--r-- | fxjs/xfa/cjx_eventpseudomodel.cpp | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/fxjs/xfa/cjx_eventpseudomodel.cpp b/fxjs/xfa/cjx_eventpseudomodel.cpp index a6a876d81b..0dea7153b7 100644 --- a/fxjs/xfa/cjx_eventpseudomodel.cpp +++ b/fxjs/xfa/cjx_eventpseudomodel.cpp @@ -6,6 +6,7 @@ #include "fxjs/xfa/cjx_eventpseudomodel.h" +#include <algorithm> #include <vector> #include "fxjs/cfxjse_engine.h" @@ -243,9 +244,25 @@ void CJX_EventPseudoModel::Property(CFXJSE_Value* pValue, break; case XFA_Event::SelectionEnd: InterProperty(pValue, &pEventParam->m_iSelEnd, bSetting); + + pEventParam->m_iSelEnd = std::max(0, pEventParam->m_iSelEnd); + pEventParam->m_iSelEnd = + std::min(static_cast<size_t>(pEventParam->m_iSelEnd), + pEventParam->m_wsPrevText.GetLength()); + pEventParam->m_iSelStart = + std::min(pEventParam->m_iSelStart, pEventParam->m_iSelEnd); + break; case XFA_Event::SelectionStart: InterProperty(pValue, &pEventParam->m_iSelStart, bSetting); + + pEventParam->m_iSelStart = std::max(0, pEventParam->m_iSelStart); + pEventParam->m_iSelStart = + std::min(static_cast<size_t>(pEventParam->m_iSelStart), + pEventParam->m_wsPrevText.GetLength()); + pEventParam->m_iSelEnd = + std::max(pEventParam->m_iSelStart, pEventParam->m_iSelEnd); + break; case XFA_Event::Shift: BooleanProperty(pValue, &pEventParam->m_bShift, bSetting); |