summaryrefslogtreecommitdiff
path: root/third_party/agg23/agg_clip_liang_barsky.h
diff options
context:
space:
mode:
authordsinclair <dsinclair@chromium.org>2016-08-09 06:50:28 -0700
committerCommit bot <commit-bot@chromium.org>2016-08-09 06:50:28 -0700
commitfb362089d952950212ccf159f86a46923f223172 (patch)
tree23692bebb1dc91a8b2998663336ec7902f540845 /third_party/agg23/agg_clip_liang_barsky.h
parent5d8e5aa882fe8d37d32b71137f039165581ddb82 (diff)
downloadpdfium-fb362089d952950212ccf159f86a46923f223172.tar.xz
Fixup various overflow conditions
There were several overflows detected by the PDF from the linked bug. This Cl fixes up the base causes of each of them. BUG=chromium:635473 Review-Url: https://codereview.chromium.org/2226023002
Diffstat (limited to 'third_party/agg23/agg_clip_liang_barsky.h')
-rw-r--r--third_party/agg23/agg_clip_liang_barsky.h15
1 files changed, 13 insertions, 2 deletions
diff --git a/third_party/agg23/agg_clip_liang_barsky.h b/third_party/agg23/agg_clip_liang_barsky.h
index db6ca97505..5b1261f004 100644
--- a/third_party/agg23/agg_clip_liang_barsky.h
+++ b/third_party/agg23/agg_clip_liang_barsky.h
@@ -20,6 +20,7 @@
#ifndef AGG_CLIP_LIANG_BARSKY_INCLUDED
#define AGG_CLIP_LIANG_BARSKY_INCLUDED
#include "agg_basics.h"
+#include "third_party/base/numerics/safe_math.h"
namespace agg
{
template<class T>
@@ -36,8 +37,18 @@ inline unsigned clip_liang_barsky(T x1, T y1, T x2, T y2,
T* x, T* y)
{
const FX_FLOAT nearzero = 1e-30f;
- FX_FLOAT deltax = (FX_FLOAT)(x2 - x1);
- FX_FLOAT deltay = (FX_FLOAT)(y2 - y1);
+
+ pdfium::base::CheckedNumeric<FX_FLOAT> width = x2;
+ width -= x1;
+ if (!width.IsValid())
+ return 0;
+ pdfium::base::CheckedNumeric<FX_FLOAT> height = y2;
+ height -= y1;
+ if (!height.IsValid())
+ return 0;
+
+ FX_FLOAT deltax = width.ValueOrDefault(0);
+ FX_FLOAT deltay = height.ValueOrDefault(0);
unsigned np = 0;
if(deltax == 0) {
deltax = (x1 > clip_box.x1) ? -nearzero : nearzero;