From e26a07588130eeaff120490a266a0a681705f006 Mon Sep 17 00:00:00 2001 From: JUN FANG Date: Sat, 11 Apr 2015 09:33:23 -0700 Subject: Merge to XFA: Fix a heap buffer overflow issue in CPDF_CMap::GetNextChar Add a check to make sure offset is less than the size of string in the function of GetNextChar(). BUG=471651 R=tsepez@chromium.org Review URL: https://codereview.chromium.org/1067073003 --- core/src/fpdfapi/fpdf_font/fpdf_font_cid.cpp | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'core/src/fpdfapi/fpdf_font/fpdf_font_cid.cpp') diff --git a/core/src/fpdfapi/fpdf_font/fpdf_font_cid.cpp b/core/src/fpdfapi/fpdf_font/fpdf_font_cid.cpp index 1ce91f9ed6..0d193e2189 100644 --- a/core/src/fpdfapi/fpdf_font/fpdf_font_cid.cpp +++ b/core/src/fpdfapi/fpdf_font/fpdf_font_cid.cpp @@ -491,7 +491,7 @@ static int _CheckCodeRange(FX_LPBYTE codes, int size, _CMap_CodeRange* pRanges, } return 0; } -FX_DWORD CPDF_CMap::GetNextChar(FX_LPCSTR pString, int& offset) const +FX_DWORD CPDF_CMap::GetNextChar(FX_LPCSTR pString, int nStrLen, int& offset) const { switch (m_CodingScheme) { case OneByte: @@ -524,7 +524,7 @@ FX_DWORD CPDF_CMap::GetNextChar(FX_LPCSTR pString, int& offset) const } return charcode; } - if (char_size == 4) { + if (char_size == 4 || offset == nStrLen) { return 0; } codes[char_size ++] = ((FX_LPBYTE)pString)[offset++]; @@ -576,7 +576,7 @@ int CPDF_CMap::CountChar(FX_LPCSTR pString, int size) const case MixedFourBytes: { int count = 0, offset = 0; while (offset < size) { - GetNextChar(pString, offset); + GetNextChar(pString, size, offset); count ++; } return count; @@ -1317,9 +1317,9 @@ int CPDF_CIDFont::GlyphFromCharCode(FX_DWORD charcode, FX_BOOL *pVertGlyph) FX_LPCBYTE pdata = m_pCIDToGIDMap->GetData() + byte_pos; return pdata[0] * 256 + pdata[1]; } -FX_DWORD CPDF_CIDFont::GetNextChar(FX_LPCSTR pString, int& offset) const +FX_DWORD CPDF_CIDFont::GetNextChar(FX_LPCSTR pString, int nStrLen, int& offset) const { - return m_pCMap->GetNextChar(pString, offset); + return m_pCMap->GetNextChar(pString, nStrLen, offset); } int CPDF_CIDFont::GetCharSize(FX_DWORD charcode) const { -- cgit v1.2.3