From af2ee2cc2e41709df7afc8f49f11ed2e8cf6dedf Mon Sep 17 00:00:00 2001 From: Nicolas Pena Date: Fri, 13 Apr 2018 20:17:26 +0000 Subject: Fix integer overflow in CPDF_Font::FallbackFontFromCharcode MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bug: chromium:831583 Change-Id: Idc980ef47cdd942bddc75d9b7fe4a56bdeacdc1a Reviewed-on: https://pdfium-review.googlesource.com/30670 Commit-Queue: Nicolás Peña Moreno Reviewed-by: Lei Zhang --- core/fpdfapi/font/cpdf_font.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'core/fpdfapi') diff --git a/core/fpdfapi/font/cpdf_font.cpp b/core/fpdfapi/font/cpdf_font.cpp index f636e9397a..ad7eeea264 100644 --- a/core/fpdfapi/font/cpdf_font.cpp +++ b/core/fpdfapi/font/cpdf_font.cpp @@ -452,9 +452,11 @@ const char* CPDF_Font::GetAdobeCharName( uint32_t CPDF_Font::FallbackFontFromCharcode(uint32_t charcode) { if (m_FontFallbacks.empty()) { m_FontFallbacks.push_back(pdfium::MakeUnique()); + pdfium::base::CheckedNumeric safeWeight = m_StemV; + safeWeight *= 5; m_FontFallbacks[0]->LoadSubst("Arial", IsTrueTypeFont(), m_Flags, - m_StemV * 5, m_ItalicAngle, 0, - IsVertWriting()); + safeWeight.ValueOrDefault(FXFONT_FW_NORMAL), + m_ItalicAngle, 0, IsVertWriting()); } return 0; } -- cgit v1.2.3