summaryrefslogtreecommitdiff
path: root/xfa
diff options
context:
space:
mode:
authorJun Fang <jun_fang@foxitsoftware.com>2016-02-23 09:00:16 +0800
committerJun Fang <jun_fang@foxitsoftware.com>2016-02-23 09:00:16 +0800
commitdb6d0600d59654f6e4a55a9e8933157ce03af10a (patch)
treef6e25d429a7a066c96bf2ddb1d230a305e444bc5 /xfa
parentb54515954635ea734eb19546fef8d0c3050590e1 (diff)
downloadpdfium-db6d0600d59654f6e4a55a9e8933157ce03af10a.tar.xz
Fix a crasher in CFX_ArrayTemplate::GetAt()
BUG=pdfium:406 R=tsepez@chromium.org Review URL: https://codereview.chromium.org/1720743003 .
Diffstat (limited to 'xfa')
-rw-r--r--xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp10
1 files changed, 4 insertions, 6 deletions
diff --git a/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp b/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp
index 7e17b77213..ed0836d539 100644
--- a/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp
+++ b/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp
@@ -1129,17 +1129,15 @@ void CXFA_ItemLayoutProcessor::DoLayoutPositionedContainer(
pContext->m_prgSpecifiedColumnWidths->GetSize() - iColIndex) {
pContext->m_fCurColumnWidth = 0;
pContext->m_bCurColumnWidthAvaiable = TRUE;
- if (iColSpan == -1) {
+ if (iColSpan == -1)
iColSpan = pContext->m_prgSpecifiedColumnWidths->GetSize();
- }
- for (int32_t i = 0; i < iColSpan; i++) {
+ for (int32_t i = 0; iColIndex + i < iColSpan; ++i) {
pContext->m_fCurColumnWidth +=
pContext->m_prgSpecifiedColumnWidths->GetAt(iColIndex + i);
}
- if (pContext->m_fCurColumnWidth == 0) {
+ if (pContext->m_fCurColumnWidth == 0)
pContext->m_bCurColumnWidthAvaiable = FALSE;
- }
- iColIndex += iColSpan;
+ iColIndex += iColSpan >= 0 ? iColSpan : 0;
}
}
pProcessor->DoLayout(FALSE, XFA_LAYOUT_FLOAT_MAX, XFA_LAYOUT_FLOAT_MAX,