diff options
| author | Oliver Chang <ochang@chromium.org> | 2016-05-27 16:34:19 -0700 |
|---|---|---|
| committer | Oliver Chang <ochang@chromium.org> | 2016-05-27 16:34:19 -0700 |
| commit | 065af557f21d4e42438d48b6b0e18ffcf33fa8a5 (patch) | |
| tree | bdab02b7233f6d3588f3ad0e4fdb8a75d816c8ee /xfa | |
| parent | 55b0a0c10c122463a15db6364ffd640cbd718299 (diff) | |
| download | pdfium-065af557f21d4e42438d48b6b0e18ffcf33fa8a5.tar.xz | |
Merge to M52: Make sure CFDE_XMLSyntaxParser's buffer is null terminated.
BUG=chromium:614962
TBR=tsepez@chromium.org
Original Review-Url: https://codereview.chromium.org/2017803002
(cherry picked from commit 816ff7b92ff0f94e4ffaafc975b08d2c4c1a6417)
Review URL: https://codereview.chromium.org/2017973003 .
Diffstat (limited to 'xfa')
| -rw-r--r-- | xfa/fde/xml/fde_xml_imp.cpp | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/xfa/fde/xml/fde_xml_imp.cpp b/xfa/fde/xml/fde_xml_imp.cpp index 446db86950..9e99deb972 100644 --- a/xfa/fde/xml/fde_xml_imp.cpp +++ b/xfa/fde/xml/fde_xml_imp.cpp @@ -8,6 +8,7 @@ #include <algorithm> +#include "core/fxcrt/include/fx_safe_types.h" #include "xfa/fgas/crt/fgas_codepage.h" #include "xfa/fgas/crt/fgas_system.h" @@ -1475,7 +1476,15 @@ void CFDE_XMLSyntaxParser::Init(IFX_Stream* pStream, uint8_t bom[4]; m_iCurrentPos = m_pStream->GetBOM(bom); ASSERT(m_pBuffer == NULL); - m_pBuffer = FX_Alloc(FX_WCHAR, m_iXMLPlaneSize); + + FX_SAFE_INT32 alloc_size_safe = m_iXMLPlaneSize; + alloc_size_safe += 1; // For NUL. + if (!alloc_size_safe.IsValid() || alloc_size_safe.ValueOrDie() <= 0) { + m_syntaxParserResult = FDE_XmlSyntaxResult::Error; + return; + } + + m_pBuffer = FX_Alloc(FX_WCHAR, alloc_size_safe.ValueOrDie()); m_pStart = m_pEnd = m_pBuffer; ASSERT(!m_BlockBuffer.IsInitialized()); m_BlockBuffer.InitBuffer(); |