Fix undefined behavior in AGG.

BUG=chromium:746232

Change-Id: Id8f22d09bc7768603ea67bd52a5a5b3d87885ea9
Reviewed-on: https://pdfium-review.googlesource.com/31370
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>

1 files changed, 7 insertions, 2 deletions

diff --git a/third_party/agg23/agg_rasterizer_scanline_aa.h b/third_party/agg23/agg_rasterizer_scanline_aa.h
index c747ee379e..da166bb14a 100644
--- a/third_party/agg23/agg_rasterizer_scanline_aa.h
+++ b/third_party/agg23/agg_rasterizer_scanline_aa.h
@@ -349,14 +349,14 @@ public:
                     cover += cur_cell->cover;
                 }
                 if(area) {
-                    alpha = calculate_alpha((cover << (poly_base_shift + 1)) - area, no_smooth);
+                    alpha = calculate_alpha(calculate_area(cover, poly_base_shift + 1) - area, no_smooth);
                     if(alpha) {
                         sl.add_cell(x, alpha);
                     }
                     x++;
                 }
                 if(num_cells && cur_cell->x > x) {
-                    alpha = calculate_alpha(cover << (poly_base_shift + 1), no_smooth);
+                    alpha = calculate_alpha(calculate_area(cover, poly_base_shift + 1), no_smooth);
                     if(alpha) {
                         sl.add_span(x, cur_cell->x - x, alpha);
                     }
@@ -458,6 +458,11 @@ private:
         m_prev_x = x;
         m_prev_y = y;
     }
+    static int calculate_area(int cover, int shift) {
+        unsigned int result = cover;
+        result <<= shift;
+        return result;
+    }
 private:
     outline_aa     m_outline;
     filling_rule_e m_filling_rule;