From 99a046acd2d1ce1f093937642b6a9165f8f41986 Mon Sep 17 00:00:00 2001 From: Dan Sinclair Date: Wed, 16 May 2018 14:09:15 +0000 Subject: Use CheckedNumeric in CFX_RTFBreak::AppendChar_Others This CL adds verification to the m_iWidth value when adding the characters width. Bug: chromium:843096 Change-Id: I7b2e7b1e786a9cba77f5aceafbb5d2bf13dc8eb9 Reviewed-on: https://pdfium-review.googlesource.com/32610 Reviewed-by: Ryan Harrison Commit-Queue: dsinclair --- xfa/fgas/layout/cfx_rtfbreak.cpp | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/xfa/fgas/layout/cfx_rtfbreak.cpp b/xfa/fgas/layout/cfx_rtfbreak.cpp index 0eb7d63a3a..f7369bd11a 100644 --- a/xfa/fgas/layout/cfx_rtfbreak.cpp +++ b/xfa/fgas/layout/cfx_rtfbreak.cpp @@ -11,6 +11,7 @@ #include "core/fxcrt/fx_arabic.h" #include "core/fxcrt/fx_bidi.h" #include "core/fxge/cfx_renderdevice.h" +#include "third_party/base/numerics/safe_math.h" #include "third_party/base/stl_util.h" #include "xfa/fgas/font/cfgas_gefont.h" #include "xfa/fgas/layout/cfx_linebreak.h" @@ -254,7 +255,13 @@ CFX_BreakType CFX_RTFBreak::AppendChar_Others(CFX_Char* pCurChar) { int iCharWidthValid = iCharWidth.ValueOrDefault(0); pCurChar->m_iCharWidth = iCharWidthValid; - m_pCurLine->m_iWidth += iCharWidthValid; + + pdfium::base::CheckedNumeric checked_width = m_pCurLine->m_iWidth; + checked_width += iCharWidthValid; + if (!checked_width.IsValid()) + return CFX_BreakType::None; + + m_pCurLine->m_iWidth = checked_width.ValueOrDie(); if (chartype != FX_CHARTYPE_Space && m_pCurLine->GetLineEnd() > m_iLineWidth + m_iTolerance) { return EndBreak(CFX_BreakType::Line); -- cgit v1.2.3