From df8fedd330e1e9916d96cefa9c2c39846bff97e9 Mon Sep 17 00:00:00 2001 From: Oliver Chang Date: Wed, 11 Nov 2015 10:16:29 -0800 Subject: Merge to M47: Prevent buffer underflow in CPDF_TextObject::CalcPositionData TBR=thestig@chromium.org BUG=554115 Review URL: https://codereview.chromium.org/1435473004 . (cherry picked from commit 46d2e278f62454ed2392630b6d18d33d380a20eb) Review URL: https://codereview.chromium.org/1438733004 . --- core/src/fpdfapi/fpdf_page/fpdf_page.cpp | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/core/src/fpdfapi/fpdf_page/fpdf_page.cpp b/core/src/fpdfapi/fpdf_page/fpdf_page.cpp index f6f03336a0..6c1f060e43 100644 --- a/core/src/fpdfapi/fpdf_page/fpdf_page.cpp +++ b/core/src/fpdfapi/fpdf_page/fpdf_page.cpp @@ -407,11 +407,11 @@ void CPDF_TextObject::CalcPositionData(FX_FLOAT* pTextAdvanceX, for (int i = 0; i < m_nChars; ++i) { FX_DWORD charcode = m_nChars == 1 ? (FX_DWORD)(uintptr_t)m_pCharCodes : m_pCharCodes[i]; - if (charcode == (FX_DWORD)-1) { - curpos -= FXSYS_Mul(m_pCharPos[i - 1], fontsize) / 1000; - continue; - } - if (i) { + if (i > 0) { + if (charcode == (FX_DWORD)-1) { + curpos -= FXSYS_Mul(m_pCharPos[i - 1], fontsize) / 1000; + continue; + } m_pCharPos[i - 1] = curpos; } FX_RECT char_rect; -- cgit v1.2.3