From d219a247dfaa697f9761ee558b58c23680509058 Mon Sep 17 00:00:00 2001 From: Jun Fang Date: Tue, 23 Feb 2016 09:25:39 +0800 Subject: Fix a crasher in CXFA_ItemLayoutProcessor::DoLayoutTableContainer() BUG=pdfium:408 R=tsepez@chromium.org Review URL: https://codereview.chromium.org/1719863002 . --- xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp b/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp index ed0836d539..071fe4d40f 100644 --- a/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp +++ b/xfa/src/fxfa/src/parser/xfa_layout_itemlayout.cpp @@ -1521,15 +1521,16 @@ void CXFA_ItemLayoutProcessor::DoLayoutTableContainer(CXFA_Node* pLayoutNode) { } } if (bMoreColumns) { - FX_FLOAT fFinalColumnWidth = m_rgSpecifiedColumnWidths[iColCount]; - for (int32_t i = 0; i < iRowCount; i++) { - if (!rgRowItems[i]) { + FX_FLOAT fFinalColumnWidth = 0.0f; + if (iColCount < m_rgSpecifiedColumnWidths.GetSize()) + fFinalColumnWidth = m_rgSpecifiedColumnWidths[iColCount]; + for (int32_t i = 0; i < iRowCount; ++i) { + if (!rgRowItems[i]) continue; - } - rgRowItemsSpan[i]--; + --rgRowItemsSpan[i]; rgRowItemsWidth[i] -= fFinalColumnWidth; } - iColCount++; + ++iColCount; } } } -- cgit v1.2.3