From e6ca7c2d7d45bd59d53c3c6f9952e2001cf81890 Mon Sep 17 00:00:00 2001 From: Henrique Nakashima Date: Fri, 22 Jun 2018 17:10:36 +0000 Subject: Fix overflow in CFX_RenderDevice::DrawFillStrokePath(). Bug: chromium:853430 Change-Id: I1c42de1e3db10dfb6399cd8abdd13c56addc8827 Reviewed-on: https://pdfium-review.googlesource.com/35850 Reviewed-by: Tom Sepez Reviewed-by: Ryan Harrison Commit-Queue: Henrique Nakashima --- core/fxge/cfx_renderdevice.cpp | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/core/fxge/cfx_renderdevice.cpp b/core/fxge/cfx_renderdevice.cpp index c63f2f5ec3..16d723721f 100644 --- a/core/fxge/cfx_renderdevice.cpp +++ b/core/fxge/cfx_renderdevice.cpp @@ -632,21 +632,24 @@ bool CFX_RenderDevice::DrawFillStrokePath(const CFX_PathData* pPathData, bbox = pObject2Device->TransformRect(bbox); FX_RECT rect = bbox.GetOuterRect(); + if (!rect.Valid()) + return false; + auto bitmap = pdfium::MakeRetain(); - auto Backdrop = pdfium::MakeRetain(); + auto backdrop = pdfium::MakeRetain(); if (!CreateCompatibleBitmap(bitmap, rect.Width(), rect.Height())) return false; if (bitmap->HasAlpha()) { bitmap->Clear(0); - Backdrop->Copy(bitmap); + backdrop->Copy(bitmap); } else { if (!m_pDeviceDriver->GetDIBits(bitmap, rect.left, rect.top)) return false; - Backdrop->Copy(bitmap); + backdrop->Copy(bitmap); } CFX_DefaultRenderDevice bitmap_device; - bitmap_device.Attach(bitmap, false, Backdrop, true); + bitmap_device.Attach(bitmap, false, backdrop, true); CFX_Matrix matrix; if (pObject2Device) -- cgit v1.2.3