From 154e18f9a862975abecebe77b8f5fb418418d14c Mon Sep 17 00:00:00 2001
From: Tom Sepez <tsepez@chromium.org>
Date: Thu, 12 Apr 2018 18:33:55 +0000
Subject: Return pdfium::span<wchar_t> from WideString::GetBuffer().

Adds bounds checking "for free", but beware of span outliving
a ReleaseBuffer() call.  Scoping as such avoids the possibility
of using an invalid span (and it is flagged as a lifetime issue).

Change-Id: Ica63f4b1429823d0254ec6951aeaeb08160cb93c
Reviewed-on: https://pdfium-review.googlesource.com/30310
Reviewed-by: dsinclair <dsinclair@chromium.org>
Commit-Queue: Tom Sepez <tsepez@chromium.org>
---
 core/fxcrt/widestring.cpp | 65 +++++++++++++++++++++++++++--------------------
 1 file changed, 37 insertions(+), 28 deletions(-)

(limited to 'core/fxcrt/widestring.cpp')

diff --git a/core/fxcrt/widestring.cpp b/core/fxcrt/widestring.cpp
index 7b5bf66fd3..a3525593ee 100644
--- a/core/fxcrt/widestring.cpp
+++ b/core/fxcrt/widestring.cpp
@@ -252,22 +252,27 @@ Optional<size_t> GuessSizeForVSWPrintf(const wchar_t* pFormat,
 Optional<WideString> TryVSWPrintf(size_t size,
                                   const wchar_t* pFormat,
                                   va_list argList) {
-  WideString str;
-  wchar_t* buffer = str.GetBuffer(size);
-
-  // In the following two calls, there's always space in the buffer for
-  // a terminating NUL that's not included in nMaxLen.
-  // For vswprintf(), MSAN won't untaint the buffer on a truncated write's
-  // -1 return code even though the buffer is written. Probably just as well
-  // not to trust the vendor's implementation to write anything anyways.
-  // See https://crbug.com/705912.
-  memset(buffer, 0, (size + 1) * sizeof(wchar_t));
-  int ret = vswprintf(buffer, size + 1, pFormat, argList);
-
-  bool bSufficientBuffer = ret >= 0 || buffer[size - 1] == 0;
-  if (!bSufficientBuffer)
+  if (!size)
     return {};
 
+  WideString str;
+  {
+    // Span's lifetime must end before ReleaseBuffer() below.
+    pdfium::span<wchar_t> buffer = str.GetBuffer(size);
+
+    // In the following two calls, there's always space in the WideString
+    // for a terminating NUL that's not included in the span.
+    // For vswprintf(), MSAN won't untaint the buffer on a truncated write's
+    // -1 return code even though the buffer is written. Probably just as well
+    // not to trust the vendor's implementation to write anything anyways.
+    // See https://crbug.com/705912.
+    memset(buffer.data(), 0, (size + 1) * sizeof(wchar_t));
+    int ret = vswprintf(buffer.data(), size + 1, pFormat, argList);
+
+    bool bSufficientBuffer = ret >= 0 || buffer[size - 1] == 0;
+    if (!bSufficientBuffer)
+      return {};
+  }
   str.ReleaseBuffer(str.GetStringLength());
   return {str};
 }
@@ -299,9 +304,12 @@ WideString GetWideString(uint16_t codepage, const ByteStringView& bstr) {
     return WideString();
 
   WideString wstr;
-  wchar_t* dest_buf = wstr.GetBuffer(dest_len);
-  FXSYS_MultiByteToWideChar(codepage, 0, bstr.unterminated_c_str(), src_len,
-                            dest_buf, dest_len);
+  {
+    // Span's lifetime must end before ReleaseBuffer() below.
+    pdfium::span<wchar_t> dest_buf = wstr.GetBuffer(dest_len);
+    FXSYS_MultiByteToWideChar(codepage, 0, bstr.unterminated_c_str(), src_len,
+                              dest_buf.data(), dest_len);
+  }
   wstr.ReleaseBuffer(dest_len);
   return wstr;
 }
@@ -586,29 +594,29 @@ void WideString::Reserve(size_t len) {
   GetBuffer(len);
 }
 
-wchar_t* WideString::GetBuffer(size_t nMinBufLength) {
+pdfium::span<wchar_t> WideString::GetBuffer(size_t nMinBufLength) {
   if (!m_pData) {
     if (nMinBufLength == 0)
-      return nullptr;
+      return pdfium::span<wchar_t>();
 
     m_pData.Reset(StringData::Create(nMinBufLength));
     m_pData->m_nDataLength = 0;
     m_pData->m_String[0] = 0;
-    return m_pData->m_String;
+    return pdfium::span<wchar_t>(m_pData->m_String, m_pData->m_nAllocLength);
   }
 
   if (m_pData->CanOperateInPlace(nMinBufLength))
-    return m_pData->m_String;
+    return pdfium::span<wchar_t>(m_pData->m_String, m_pData->m_nAllocLength);
 
   nMinBufLength = std::max(nMinBufLength, m_pData->m_nDataLength);
   if (nMinBufLength == 0)
-    return nullptr;
+    return pdfium::span<wchar_t>();
 
   RetainPtr<StringData> pNewData(StringData::Create(nMinBufLength));
   pNewData->CopyContents(*m_pData);
   pNewData->m_nDataLength = m_pData->m_nDataLength;
   m_pData.Swap(pNewData);
-  return m_pData->m_String;
+  return pdfium::span<wchar_t>(m_pData->m_String, m_pData->m_nAllocLength);
 }
 
 size_t WideString::Delete(size_t index, size_t count) {
@@ -885,14 +893,15 @@ WideString WideString::FromUTF8(const ByteStringView& str) {
 
 // static
 WideString WideString::FromUTF16LE(const unsigned short* wstr, size_t wlen) {
-  if (!wstr || wlen == 0) {
+  if (!wstr || wlen == 0)
     return WideString();
-  }
 
   WideString result;
-  wchar_t* buf = result.GetBuffer(wlen);
-  for (size_t i = 0; i < wlen; i++) {
-    buf[i] = wstr[i];
+  {
+    // Span's lifetime must end before ReleaseBuffer() below.
+    pdfium::span<wchar_t> buf = result.GetBuffer(wlen);
+    for (size_t i = 0; i < wlen; i++)
+      buf[i] = wstr[i];
   }
   result.ReleaseBuffer(wlen);
   return result;
-- 
cgit v1.2.3