From 8538642e103530670a69572905557be58e677e1a Mon Sep 17 00:00:00 2001
From: Tom Sepez <tsepez@chromium.org>
Date: Wed, 23 Jul 2014 10:28:37 -0700
Subject: Fix lookahead beyond bounds in CJS_PublicMethods::MakeFormatDate().

BUG=396255
R=jun_fang@foxitsoftware.com

Review URL: https://codereview.chromium.org/407243003
---
 fpdfsdk/src/javascript/PublicMethods.cpp | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/fpdfsdk/src/javascript/PublicMethods.cpp b/fpdfsdk/src/javascript/PublicMethods.cpp
index 55228687bc..08d5cb707c 100644
--- a/fpdfsdk/src/javascript/PublicMethods.cpp
+++ b/fpdfsdk/src/javascript/PublicMethods.cpp
@@ -924,10 +924,10 @@ CFX_WideString CJS_PublicMethods::MakeFormatDate(double dDate, const CFX_WideStr
 	int nSec = JS_GetSecFromTime(dDate);
 
 	int i = 0;
-	FX_WCHAR c;
 	while (i < format.GetLength())
 	{
-		c = format.GetAt(i);
+	        FX_WCHAR c = format.GetAt(i);
+                int remaining = format.GetLength() - i - 1;
 		sPart = L"";
 		switch (c)
 		{
@@ -939,7 +939,7 @@ CFX_WideString CJS_PublicMethods::MakeFormatDate(double dDate, const CFX_WideStr
 			case 'M':
 			case 's':
 			case 't':
-				if (format.GetAt(i+1) != c)
+				if (remaining == 0 || format.GetAt(i+1) != c)
 				{
 					switch (c)
 					{
@@ -964,13 +964,13 @@ CFX_WideString CJS_PublicMethods::MakeFormatDate(double dDate, const CFX_WideStr
 						case 's':
 							sPart.Format((FX_LPCWSTR)L"%d",nSec);
 							break;
-						case 't':				
+						case 't':
 							sPart += nHour>12?'p':'a';
 							break;
-					}					
+					}
 					i++;
 				}
-				else if (format.GetAt(i+1) == c && format.GetAt(i+2) != c)
+				else if (remaining == 1 || format.GetAt(i+2) != c)
 				{
 					switch (c)
 					{
@@ -995,14 +995,14 @@ CFX_WideString CJS_PublicMethods::MakeFormatDate(double dDate, const CFX_WideStr
 						case 's':
 							sPart.Format((FX_LPCWSTR)L"%02d",nSec);
 							break;
-						case 't':							
+						case 't':
 							sPart = nHour>12? (FX_LPCWSTR)L"pm": (FX_LPCWSTR)L"am";
 							break;
-					}			
+					}
 					i+=2;
 				}
-				else if (format.GetAt(i+1) == c && format.GetAt(i+2) == c && format.GetAt(i+3) != c)
-				{		
+				else if (remaining == 2 || format.GetAt(i+3) != c)
+				{
 					switch (c)
 					{
 						case 'm':
@@ -1016,16 +1016,16 @@ CFX_WideString CJS_PublicMethods::MakeFormatDate(double dDate, const CFX_WideStr
 							sPart += c;
 							sPart += c;
 							break;
-					}					
+					}
 				}
-				else if (format.GetAt(i+1) == c && format.GetAt(i+2) == c && format.GetAt(i+3) == c && format.GetAt(i+4) != c)
+				else if (remaining == 3 || format.GetAt(i+4) != c)
 				{
 					switch (c)
 					{
 						case 'y':
 							sPart.Format((FX_LPCWSTR)L"%04d",nYear);
 							i += 4;
-							break;	
+							break;
 						case 'm':
 							i+=4;
 							if (nMonth > 0&&nMonth <= 12)
@@ -1038,20 +1038,20 @@ CFX_WideString CJS_PublicMethods::MakeFormatDate(double dDate, const CFX_WideStr
 							sPart += c;
 							sPart += c;
 							break;
-					}					
+					}
 				}
 				else
 				{
 					i++;
 					sPart += c;
 				}
-				break;			
+				break;
 			default:
 				i++;
 				sPart += c;
 				break;
 		}
-		
+
 		sRet += sPart;
 	}
 
-- 
cgit v1.2.3