From 2fd400c319c68b4b8bd741c0df51c8846c40a276 Mon Sep 17 00:00:00 2001 From: Bo Xu Date: Thu, 31 Jul 2014 09:55:36 -0700 Subject: Fix integer overflow when stretch bitmap When an image object is zoomed in by a big factor, the scaling factor in the transformation matrix is big as well, resulting in a large |dest_width| and |dest_height| value(they can be think of as the equivalent pixel size of the entire image, although most of it is outside the device). BUG=395636 R=vitalybuka@chromium.org Review URL: https://codereview.chromium.org/432543002 --- core/src/fxge/win32/fx_win32_device.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/src/fxge/win32/fx_win32_device.cpp b/core/src/fxge/win32/fx_win32_device.cpp index 154bbc407c..5e76898db1 100644 --- a/core/src/fxge/win32/fx_win32_device.cpp +++ b/core/src/fxge/win32/fx_win32_device.cpp @@ -523,7 +523,7 @@ FX_BOOL CGdiDeviceDriver::GDI_StretchDIBits(const CFX_DIBitmap* pBitmap1, int de return FALSE; } CFX_ByteString info = CFX_WindowsDIB::GetBitmapInfo(pBitmap); - if (abs(dest_width) * abs(dest_height) < pBitmap1->GetWidth() * pBitmap1->GetHeight() * 4 || + if ((FX_INT64)abs(dest_width) * abs(dest_height) < (FX_INT64)pBitmap1->GetWidth() * pBitmap1->GetHeight() * 4 || (flags & FXDIB_INTERPOL) || (flags & FXDIB_BICUBIC_INTERPOL)) { SetStretchBltMode(m_hDC, HALFTONE); } else { @@ -531,7 +531,7 @@ FX_BOOL CGdiDeviceDriver::GDI_StretchDIBits(const CFX_DIBitmap* pBitmap1, int de } CFX_DIBitmap* pToStrechBitmap = pBitmap; bool del = false; - if (m_DeviceClass == FXDC_PRINTER && (pBitmap->GetWidth() * pBitmap->GetHeight() > abs(dest_width) * abs(dest_height))) { + if (m_DeviceClass == FXDC_PRINTER && ((FX_INT64)pBitmap->GetWidth() * pBitmap->GetHeight() > (FX_INT64)abs(dest_width) * abs(dest_height))) { pToStrechBitmap = pBitmap->StretchTo(dest_width, dest_height); del = true; } -- cgit v1.2.3