summaryrefslogtreecommitdiff
path: root/core
diff options
context:
space:
mode:
Diffstat (limited to 'core')
-rw-r--r--core/fpdfapi/fpdf_render/fpdf_render_pattern.cpp15
1 files changed, 13 insertions, 2 deletions
diff --git a/core/fpdfapi/fpdf_render/fpdf_render_pattern.cpp b/core/fpdfapi/fpdf_render/fpdf_render_pattern.cpp
index 090060d2c0..afcaa8dd19 100644
--- a/core/fpdfapi/fpdf_render/fpdf_render_pattern.cpp
+++ b/core/fpdfapi/fpdf_render/fpdf_render_pattern.cpp
@@ -1138,8 +1138,19 @@ void CPDF_RenderStatus::DrawTilingPattern(CPDF_TilingPattern* pPattern,
FX_FLOAT orig_x = col * pPattern->x_step();
FX_FLOAT orig_y = row * pPattern->y_step();
mtPattern2Device.Transform(orig_x, orig_y);
- start_x = FXSYS_round(orig_x + left_offset) - clip_box.left;
- start_y = FXSYS_round(orig_y + top_offset) - clip_box.top;
+
+ pdfium::base::CheckedNumeric<int> safeStartX =
+ FXSYS_round(orig_x + left_offset);
+ pdfium::base::CheckedNumeric<int> safeStartY =
+ FXSYS_round(orig_y + top_offset);
+
+ safeStartX -= clip_box.left;
+ safeStartY -= clip_box.top;
+ if (!safeStartX.IsValid() || !safeStartY.IsValid())
+ return;
+
+ start_x = safeStartX.ValueOrDefault(0);
+ start_y = safeStartY.ValueOrDefault(0);
}
if (width == 1 && height == 1) {
if (start_x < 0 || start_x >= clip_box.Width() || start_y < 0 ||