From dce09b18b48837d8006694b9dc3b2d026e5e7869 Mon Sep 17 00:00:00 2001 From: Henrique Nakashima Date: Fri, 1 Sep 2017 12:14:26 -0400 Subject: Fix integer overflow in Buffer_itoa when passing INT_MIN. Bug: chromium:760034 Change-Id: Id0862749b1454e065de4de7d746a27e78ac58e30 Reviewed-on: https://pdfium-review.googlesource.com/12730 Commit-Queue: Henrique Nakashima Reviewed-by: Tom Sepez --- core/fxcrt/cfx_bytestring.cpp | 32 +++----------------------------- 1 file changed, 3 insertions(+), 29 deletions(-) (limited to 'core/fxcrt/cfx_bytestring.cpp') diff --git a/core/fxcrt/cfx_bytestring.cpp b/core/fxcrt/cfx_bytestring.cpp index a8b65b5c2f..ab7c9aee99 100644 --- a/core/fxcrt/cfx_bytestring.cpp +++ b/core/fxcrt/cfx_bytestring.cpp @@ -27,33 +27,6 @@ template struct std::hash; namespace { -int Buffer_itoa(char* buf, int i, uint32_t flags) { - if (i == 0) { - buf[0] = '0'; - return 1; - } - char buf1[32]; - int buf_pos = 31; - uint32_t u = i; - if ((flags & FXFORMAT_SIGNED) && i < 0) { - u = -i; - } - int base = 10; - const char* str = "0123456789abcdef"; - while (u != 0) { - buf1[buf_pos--] = str[u % base]; - u = u / base; - } - if ((flags & FXFORMAT_SIGNED) && i < 0) { - buf1[buf_pos--] = '-'; - } - int len = 31 - buf_pos; - for (int ii = 0; ii < len; ii++) { - buf[ii] = buf1[ii + buf_pos + 1]; - } - return len; -} - const char* FX_strstr(const char* haystack, int haystack_len, const char* needle, @@ -499,9 +472,10 @@ void CFX_ByteString::AllocCopy(CFX_ByteString& dest, #define FORCE_UNICODE 0x20000 #define FORCE_INT64 0x40000 -CFX_ByteString CFX_ByteString::FormatInteger(int i, uint32_t flags) { +CFX_ByteString CFX_ByteString::FormatInteger(int i) { char buf[32]; - return CFX_ByteString(buf, Buffer_itoa(buf, i, flags)); + FXSYS_snprintf(buf, 32, "%d", i); + return CFX_ByteString(buf); } void CFX_ByteString::FormatV(const char* pFormat, va_list argList) { -- cgit v1.2.3