From 41c23536d10b04f56d0c4dfd1c36ee4664d9b7f9 Mon Sep 17 00:00:00 2001 From: tsepez Date: Tue, 24 Jan 2017 09:31:33 -0800 Subject: Undefined shift in CPDF_PSEngine::DoOperator Also fix an unsafe negation in same block. BUG=641551 BUG=681091 Review-Url: https://codereview.chromium.org/2649283002 --- core/fpdfapi/page/fpdf_page_func.cpp | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/core/fpdfapi/page/fpdf_page_func.cpp b/core/fpdfapi/page/fpdf_page_func.cpp index 9949e052c9..916641f05d 100644 --- a/core/fpdfapi/page/fpdf_page_func.cpp +++ b/core/fpdfapi/page/fpdf_page_func.cpp @@ -410,12 +410,15 @@ bool CPDF_PSEngine::DoOperator(PDF_PSOP op) { break; case PSOP_BITSHIFT: { int shift = (int)Pop(); - int i = (int)Pop(); + result = (int)Pop(); if (shift > 0) { - Push(i << shift); + result <<= shift; } else { - Push(i >> -shift); + // Avoids unsafe negation of INT_MIN. + FX_SAFE_INT32 safe_shift = shift; + result >>= (-safe_shift).ValueOrDefault(0); } + Push(result.ValueOrDefault(0)); break; } case PSOP_TRUE: -- cgit v1.2.3