summaryrefslogtreecommitdiff
path: root/xfa/src/fxfa
diff options
context:
space:
mode:
authorJUN FANG <jun_fang@foxitsoftware.com>2015-05-13 14:34:28 -0700
committerJUN FANG <jun_fang@foxitsoftware.com>2015-05-13 14:34:28 -0700
commit130c7d1c5bb4bd983e4b8fd75ea8aecea5a2c0d8 (patch)
tree40fa6956e147d8455180eeaf5aea62f071233197 /xfa/src/fxfa
parente83c77e9a68f2e0ac7632ac40f5b09a0e888093a (diff)
downloadpdfium-130c7d1c5bb4bd983e4b8fd75ea8aecea5a2c0d8.tar.xz
Fix a global buffer overflow issue in CXFA_ItemLayoutProcessor::CalculatePositionedContainerPos
BUG=471991 R=tsepez@chromium.org Review URL: https://codereview.chromium.org/1138993002
Diffstat (limited to 'xfa/src/fxfa')
-rw-r--r--xfa/src/fxfa/src/common/xfa_utils.h32
-rw-r--r--xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp16
-rw-r--r--xfa/src/fxfa/src/parser/xfa_objectacc_imp.cpp9
-rw-r--r--xfa/src/fxfa/src/parser/xfa_utils_imp.cpp8
-rw-r--r--xfa/src/fxfa/src/parser/xfa_utils_imp_unittest.cpp36
5 files changed, 73 insertions, 28 deletions
diff --git a/xfa/src/fxfa/src/common/xfa_utils.h b/xfa/src/fxfa/src/common/xfa_utils.h
index c6f0c4773b..b666397e83 100644
--- a/xfa/src/fxfa/src/common/xfa_utils.h
+++ b/xfa/src/fxfa/src/common/xfa_utils.h
@@ -216,22 +216,24 @@ public:
class CXFA_Node;
class CXFA_WidgetData;
#include "fxfa_localevalue.h"
-CXFA_Node* XFA_CreateUIChild(CXFA_Node* pNode, XFA_ELEMENT& eWidgetType);
-CXFA_LocaleValue XFA_GetLocaleValue(CXFA_WidgetData* pWidgetData);
-CFX_WideString XFA_NumericLimit(const CFX_WideString &wsValue, FX_INT32 iLead, FX_INT32 iTread);
-FX_DOUBLE XFA_WideStringToDouble(const CFX_WideString &wsStringVal);
-FX_DOUBLE XFA_ByteStringToDouble(FX_BSTR szStringVal);
+CXFA_Node* XFA_CreateUIChild(CXFA_Node* pNode, XFA_ELEMENT& eWidgetType);
+CXFA_LocaleValue XFA_GetLocaleValue(CXFA_WidgetData* pWidgetData);
+CFX_WideString XFA_NumericLimit(const CFX_WideString &wsValue, FX_INT32 iLead, FX_INT32 iTread);
+FX_DOUBLE XFA_WideStringToDouble(const CFX_WideString &wsStringVal);
+FX_DOUBLE XFA_ByteStringToDouble(FX_BSTR szStringVal);
+FX_INT32 XFA_MapRotation(FX_INT32 nRotation);
#ifndef XFA_PARSE_HAS_LINEIDENTIFIER
#define XFA_PARSE_HAS_LINEIDENTIFIER
#endif
-FX_BOOL XFA_RecognizeRichText(IFDE_XMLElement* pRichTextXMLNode);
-void XFA_GetPlainTextFromRichText(IFDE_XMLNode *pXMLNode, CFX_WideString &wsPlainText);
-FX_BOOL XFA_FieldIsMultiListBox(CXFA_Node* pFieldNode);
-IFX_Stream* XFA_CreateWideTextRead(const CFX_WideString &wsBuffer);
-FX_BOOL XFA_IsLayoutElement(XFA_ELEMENT eElement, FX_BOOL bLayoutContainer = FALSE);
-FX_BOOL XFA_IsTakingupSpace(XFA_ATTRIBUTEENUM ePresence);
-FX_BOOL XFA_IsFlowingLayout(XFA_ATTRIBUTEENUM eLayout);
-FX_BOOL XFA_IsHorizontalFlow(XFA_ATTRIBUTEENUM eLayout);
-void XFA_DataExporter_DealWithDataGroupNode(CXFA_Node *pDataNode);
-void XFA_DataExporter_RegenerateFormFile(CXFA_Node* pNode, IFX_Stream* pStream, FX_LPCSTR pChecksum = NULL, FX_BOOL bSaveXML = FALSE);
+FX_BOOL XFA_RecognizeRichText(IFDE_XMLElement* pRichTextXMLNode);
+void XFA_GetPlainTextFromRichText(IFDE_XMLNode *pXMLNode, CFX_WideString &wsPlainText);
+FX_BOOL XFA_FieldIsMultiListBox(CXFA_Node* pFieldNode);
+IFX_Stream* XFA_CreateWideTextRead(const CFX_WideString &wsBuffer);
+FX_BOOL XFA_IsLayoutElement(XFA_ELEMENT eElement, FX_BOOL bLayoutContainer = FALSE);
+FX_BOOL XFA_IsTakingupSpace(XFA_ATTRIBUTEENUM ePresence);
+FX_BOOL XFA_IsFlowingLayout(XFA_ATTRIBUTEENUM eLayout);
+FX_BOOL XFA_IsHorizontalFlow(XFA_ATTRIBUTEENUM eLayout);
+void XFA_DataExporter_DealWithDataGroupNode(CXFA_Node *pDataNode);
+void XFA_DataExporter_RegenerateFormFile(CXFA_Node* pNode, IFX_Stream* pStream,
+ FX_LPCSTR pChecksum = NULL, FX_BOOL bSaveXML = FALSE);
#endif
diff --git a/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp b/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp
index e6a2070088..228086734b 100644
--- a/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp
+++ b/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp
@@ -712,10 +712,6 @@ static inline void XFA_ItemLayoutProcessor_CalculateContainerComponentSizeFromCo
}
void CXFA_ItemLayoutProcessor::CalculatePositionedContainerPos(CXFA_Node* pNode, FX_FLOAT fWidth, FX_FLOAT fHeight, FX_FLOAT& fAbsoluteX, FX_FLOAT& fAbsoluteY)
{
- FX_FLOAT fAnchorX = pNode->GetMeasure(XFA_ATTRIBUTE_X).ToUnit(XFA_UNIT_Pt);
- FX_FLOAT fAnchorY = pNode->GetMeasure(XFA_ATTRIBUTE_Y).ToUnit(XFA_UNIT_Pt);
- FX_INT32 nRotate = FXSYS_round(pNode->GetMeasure(XFA_ATTRIBUTE_Rotate).GetValue());
- nRotate = (nRotate < 0 ? (nRotate % 360) + 360 : nRotate % 360) / 90;
XFA_ATTRIBUTEENUM eAnchorType = pNode->GetEnum(XFA_ATTRIBUTE_AnchorType);
FX_INT32 nAnchorType = 0;
switch(eAnchorType) {
@@ -749,7 +745,15 @@ void CXFA_ItemLayoutProcessor::CalculatePositionedContainerPos(CXFA_Node* pNode,
default:
break;
}
- static const FX_UINT8 nNextPos[4][9] = {{0, 1, 2, 3, 4, 5, 6, 7, 8}, {6, 3, 0, 7, 4, 1, 8, 5, 2}, {8, 7, 6, 5, 4, 3, 2, 1, 0}, {2, 5, 8, 1, 4, 7, 0, 3, 6}};
+ static const FX_UINT8 nNextPos[4][9] = { {0, 1, 2, 3, 4, 5, 6, 7, 8},
+ {6, 3, 0, 7, 4, 1, 8, 5, 2},
+ {8, 7, 6, 5, 4, 3, 2, 1, 0},
+ {2, 5, 8, 1, 4, 7, 0, 3, 6} };
+
+ FX_FLOAT fAnchorX = pNode->GetMeasure(XFA_ATTRIBUTE_X).ToUnit(XFA_UNIT_Pt);
+ FX_FLOAT fAnchorY = pNode->GetMeasure(XFA_ATTRIBUTE_Y).ToUnit(XFA_UNIT_Pt);
+ FX_INT32 nRotate = FXSYS_round(pNode->GetMeasure(XFA_ATTRIBUTE_Rotate).GetValue());
+ nRotate = XFA_MapRotation(nRotate) / 90;
FX_INT32 nAbsoluteAnchorType = nNextPos[nRotate][nAnchorType];
fAbsoluteX = fAnchorX;
fAbsoluteY = fAnchorY;
@@ -2297,7 +2301,7 @@ void CXFA_ItemLayoutProcessor::DoLayoutField()
FX_FLOAT fWidth = -1;
pNotify->StartFieldDrawLayout(m_pFormNode, fWidth, fHeight);
FX_INT32 nRotate = FXSYS_round(m_pFormNode->GetMeasure(XFA_ATTRIBUTE_Rotate).GetValue());
- nRotate = (nRotate < 0 ? (nRotate % 360) + 360 : nRotate % 360);
+ nRotate = XFA_MapRotation(nRotate);
if(nRotate == 90 || nRotate == 270) {
FX_FLOAT fTmp = fWidth;
fWidth = fHeight;
diff --git a/xfa/src/fxfa/src/parser/xfa_objectacc_imp.cpp b/xfa/src/fxfa/src/parser/xfa_objectacc_imp.cpp
index c3bcd5e20f..c6ece3691b 100644
--- a/xfa/src/fxfa/src/parser/xfa_objectacc_imp.cpp
+++ b/xfa/src/fxfa/src/parser/xfa_objectacc_imp.cpp
@@ -1792,7 +1792,7 @@ FX_INT32 CXFA_WidgetData::GetRotate()
return 0;
}
FX_INT32 iRotate = FXSYS_round(ms.GetValue());
- iRotate = (iRotate < 0 ? (iRotate % 360) + 360 : iRotate % 360);
+ iRotate = XFA_MapRotation(iRotate);
return iRotate / 90 * 90;
}
CXFA_Border CXFA_WidgetData::GetBorder(FX_BOOL bModified)
@@ -1933,12 +1933,7 @@ FX_BOOL CXFA_WidgetData::SetPresence(FX_INT32 iPresence)
}
FX_BOOL CXFA_WidgetData::SetRotate(FX_INT32 iRotate)
{
- while (iRotate < 0) {
- iRotate += 360;
- }
- while (iRotate >= 360) {
- iRotate -= 360;
- }
+ iRotate = XFA_MapRotation(iRotate);
CXFA_Measurement ms((FX_FLOAT)iRotate, XFA_UNIT_Angle);
return m_pNode->SetMeasure(XFA_ATTRIBUTE_Rotate, ms);
}
diff --git a/xfa/src/fxfa/src/parser/xfa_utils_imp.cpp b/xfa/src/fxfa/src/parser/xfa_utils_imp.cpp
index 9c7ca9c274..e4f7545f98 100644
--- a/xfa/src/fxfa/src/parser/xfa_utils_imp.cpp
+++ b/xfa/src/fxfa/src/parser/xfa_utils_imp.cpp
@@ -375,8 +375,16 @@ FX_DOUBLE XFA_WideStringToDouble(const CFX_WideString &wsStringVal)
}
return dValue;
}
+
FX_DOUBLE XFA_ByteStringToDouble(FX_BSTR szStringVal)
{
CFX_WideString wsValue = CFX_WideString::FromUTF8(szStringVal.GetCStr(), szStringVal.GetLength());
return XFA_WideStringToDouble(wsValue);
}
+
+FX_INT32 XFA_MapRotation(FX_INT32 nRotation) {
+ nRotation = nRotation % 360;
+ nRotation = nRotation < 0 ? nRotation + 360 : nRotation;
+ return nRotation;
+}
+
diff --git a/xfa/src/fxfa/src/parser/xfa_utils_imp_unittest.cpp b/xfa/src/fxfa/src/parser/xfa_utils_imp_unittest.cpp
new file mode 100644
index 0000000000..a9698721b2
--- /dev/null
+++ b/xfa/src/fxfa/src/parser/xfa_utils_imp_unittest.cpp
@@ -0,0 +1,36 @@
+// Copyright 2014 PDFium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "../../../testing/gtest/include/gtest/gtest.h"
+#include "../../../foxitlib.h"
+#include "../common/xfa_utils.h"
+
+TEST(XfaUtilsImp, XFA_MapRotation) {
+ struct TestCase {
+ int input;
+ int expected_output;
+ } TestCases[] = {
+ {-1000000, 80},
+ {-361, 359},
+ {-360, 0},
+ {-359, 1},
+ {-91, 269},
+ {-90, 270},
+ {-89, 271},
+ {-1, 359},
+ {0, 0},
+ {1, 1},
+ {89, 89},
+ {90, 90},
+ {91, 91},
+ {359, 359},
+ {360, 0},
+ {361, 1},
+ {100000, 280}
+ };
+
+ for (size_t i = 0; i < FX_ArraySize(TestCases); ++i) {
+ EXPECT_EQ(TestCases[i].expected_output, XFA_MapRotation(TestCases[i].input));
+ }
+}