From ddb9b7cdd19b63a81c4a094239e85f84acefaa17 Mon Sep 17 00:00:00 2001 From: Ryan Harrison Date: Fri, 11 Aug 2017 16:20:32 -0400 Subject: Add checks of index operations on string classes Specifically the index parameter passed in to GetAt(), SetAt() and operator[] are now being tested to be in bounds. BUG=chromium:752480, pdfium:828 Change-Id: I9e94d58c98a8eaaaae53cd0e3ffe2123ea17d8c4 Reviewed-on: https://pdfium-review.googlesource.com/10651 Commit-Queue: Ryan Harrison Reviewed-by: Tom Sepez --- core/fpdfdoc/cpdf_variabletext.cpp | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) (limited to 'core/fpdfdoc') diff --git a/core/fpdfdoc/cpdf_variabletext.cpp b/core/fpdfdoc/cpdf_variabletext.cpp index 1fc32946fc..74a5e3adfc 100644 --- a/core/fpdfdoc/cpdf_variabletext.cpp +++ b/core/fpdfdoc/cpdf_variabletext.cpp @@ -430,18 +430,16 @@ void CPDF_VariableText::SetText(const CFX_WideString& swText) { switch (word) { case 0x0D: if (m_bMultiLine) { - if (swText.GetAt(i + 1) == 0x0A) - i += 1; - + if (i + 1 < sz && swText.GetAt(i + 1) == 0x0A) + i++; wp.AdvanceSection(); AddSection(wp, secinfo); } break; case 0x0A: if (m_bMultiLine) { - if (swText.GetAt(i + 1) == 0x0D) - i += 1; - + if (i + 1 < sz && swText.GetAt(i + 1) == 0x0D) + i++; wp.AdvanceSection(); AddSection(wp, secinfo); } -- cgit v1.2.3