summaryrefslogtreecommitdiff
path: root/xfa/fgas/layout
diff options
context:
space:
mode:
authorDan Sinclair <dsinclair@chromium.org>2018-05-16 14:09:15 +0000
committerChromium commit bot <commit-bot@chromium.org>2018-05-16 14:09:15 +0000
commit99a046acd2d1ce1f093937642b6a9165f8f41986 (patch)
tree93c776fa79e4bd9f6e60cff3587b6e6053497c0c /xfa/fgas/layout
parenta68ee04cfdeb39637a06764dcb924ac806dfdf95 (diff)
downloadpdfium-99a046acd2d1ce1f093937642b6a9165f8f41986.tar.xz
Use CheckedNumeric in CFX_RTFBreak::AppendChar_Others
This CL adds verification to the m_iWidth value when adding the characters width. Bug: chromium:843096 Change-Id: I7b2e7b1e786a9cba77f5aceafbb5d2bf13dc8eb9 Reviewed-on: https://pdfium-review.googlesource.com/32610 Reviewed-by: Ryan Harrison <rharrison@chromium.org> Commit-Queue: dsinclair <dsinclair@chromium.org>
Diffstat (limited to 'xfa/fgas/layout')
-rw-r--r--xfa/fgas/layout/cfx_rtfbreak.cpp9
1 files changed, 8 insertions, 1 deletions
diff --git a/xfa/fgas/layout/cfx_rtfbreak.cpp b/xfa/fgas/layout/cfx_rtfbreak.cpp
index 0eb7d63a3a..f7369bd11a 100644
--- a/xfa/fgas/layout/cfx_rtfbreak.cpp
+++ b/xfa/fgas/layout/cfx_rtfbreak.cpp
@@ -11,6 +11,7 @@
#include "core/fxcrt/fx_arabic.h"
#include "core/fxcrt/fx_bidi.h"
#include "core/fxge/cfx_renderdevice.h"
+#include "third_party/base/numerics/safe_math.h"
#include "third_party/base/stl_util.h"
#include "xfa/fgas/font/cfgas_gefont.h"
#include "xfa/fgas/layout/cfx_linebreak.h"
@@ -254,7 +255,13 @@ CFX_BreakType CFX_RTFBreak::AppendChar_Others(CFX_Char* pCurChar) {
int iCharWidthValid = iCharWidth.ValueOrDefault(0);
pCurChar->m_iCharWidth = iCharWidthValid;
- m_pCurLine->m_iWidth += iCharWidthValid;
+
+ pdfium::base::CheckedNumeric<int32_t> checked_width = m_pCurLine->m_iWidth;
+ checked_width += iCharWidthValid;
+ if (!checked_width.IsValid())
+ return CFX_BreakType::None;
+
+ m_pCurLine->m_iWidth = checked_width.ValueOrDie();
if (chartype != FX_CHARTYPE_Space &&
m_pCurLine->GetLineEnd() > m_iLineWidth + m_iTolerance) {
return EndBreak(CFX_BreakType::Line);