From 98a245c0d8ee3e403fbb13d90872239948d82abf Mon Sep 17 00:00:00 2001 From: Nicolas Pena Date: Wed, 22 Aug 2018 15:15:36 +0000 Subject: Fix integer overflow in CPDF_CIDFont::GetCharBBox MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bug: chromium:875924 Change-Id: I85c86d3f90ee62b5593b0b20e44283c5056702ff Reviewed-on: https://pdfium-review.googlesource.com/40730 Reviewed-by: Lei Zhang Commit-Queue: Nicolás Peña Moreno --- core/fpdfapi/font/cpdf_cidfont.cpp | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) (limited to 'core/fpdfapi') diff --git a/core/fpdfapi/font/cpdf_cidfont.cpp b/core/fpdfapi/font/cpdf_cidfont.cpp index e118a91e87..a423daa1bb 100644 --- a/core/fpdfapi/font/cpdf_cidfont.cpp +++ b/core/fpdfapi/font/cpdf_cidfont.cpp @@ -119,8 +119,11 @@ const struct CIDTransform { }; // Boundary values to avoid integer overflow when multiplied by 1000. -const long kMinCBox = -2147483; -const long kMaxCBox = 2147483; +constexpr long kMinCBox = -2147483; +constexpr long kMaxCBox = 2147483; + +// Boundary value to avoid integer overflow when adding 1/64th of the value. +constexpr int kMaxRectTop = 2114445437; CPDF_FontGlobals* GetFontGlobals() { return CPDF_ModuleMgr::Get()->GetPageModule()->GetFontGlobals(); @@ -472,7 +475,10 @@ FX_RECT CPDF_CIDFont::GetCharBBox(uint32_t charcode) { TT2PDF(FXFT_Get_Glyph_HoriBearingY(face) - FXFT_Get_Glyph_Height(face), face)); - rect.top += rect.top / 64; + if (rect.top <= kMaxRectTop) + rect.top += rect.top / 64; + else + rect.top = std::numeric_limits::max(); } } } -- cgit v1.2.3