summaryrefslogtreecommitdiff
path: root/xfa/fxfa/app/xfa_fontmgr.cpp
diff options
context:
space:
mode:
authorstackexploit <stackexploit@gmail.com>2016-09-26 13:54:55 -0700
committerCommit bot <commit-bot@chromium.org>2016-09-26 13:54:56 -0700
commit5aed0216ad6574944e76a95ef0dbbc910bab4a1a (patch)
tree9b01025004edc0a10f9c750cc53d69f0d72691c9 /xfa/fxfa/app/xfa_fontmgr.cpp
parent9c33e89a43fd316fb42a7134d34585eb04c60416 (diff)
downloadpdfium-5aed0216ad6574944e76a95ef0dbbc910bab4a1a.tar.xz
Strengthen bounds check in CWeightTable::Calc.
The buffer PixelWeight.m_Weights was allocated by calling FX_TryAlloc(uint8_t, m_dwWeightTablesSize), but PixelWeight.m_Weights was an int array. Thus bounds check such as |if (idx >= m_dwWeightTablesSize)| in function CWeightTable::Calc() and |idx < m_dwWeightTablesSize ? &pWeight->m_Weights[idx] : nullptr| in function CWeightTable::GetValueFromPixelWeight() were insufficient. This CL strengthens bounds check for accessing int type array PixelWeight.m_Weights. BUG=chromium:619398 R=ochang@chromium.org, thestig@chromium.org Review-Url: https://codereview.chromium.org/2322903002
Diffstat (limited to 'xfa/fxfa/app/xfa_fontmgr.cpp')
0 files changed, 0 insertions, 0 deletions