From c70b19aad245fb1ed39bf8c264d991555f4c5a58 Mon Sep 17 00:00:00 2001
From: Jun Fang <jun_fang@foxitsoftware.com>
Date: Wed, 25 Nov 2015 11:13:50 +0800
Subject: Fix invalid buffer length set in CFX_WideString::UTF16LE_Encode()

BUG=pdfium:275
R=tsepez@chromium.org

Review URL: https://codereview.chromium.org/1443603002 .
---
 core/src/fxcrt/fx_basic_buffer.cpp           |  5 +++--
 core/src/fxcrt/fx_basic_wstring.cpp          | 14 ++++++--------
 core/src/fxcrt/fx_basic_wstring_unittest.cpp | 12 ++++++------
 3 files changed, 15 insertions(+), 16 deletions(-)

(limited to 'core/src')

diff --git a/core/src/fxcrt/fx_basic_buffer.cpp b/core/src/fxcrt/fx_basic_buffer.cpp
index f606f1d368..1178331283 100644
--- a/core/src/fxcrt/fx_basic_buffer.cpp
+++ b/core/src/fxcrt/fx_basic_buffer.cpp
@@ -318,8 +318,9 @@ CFX_ArchiveLoader& CFX_ArchiveLoader::operator>>(CFX_ByteString& str) {
 CFX_ArchiveLoader& CFX_ArchiveLoader::operator>>(CFX_WideString& str) {
   CFX_ByteString encoded;
   operator>>(encoded);
-  str = CFX_WideString::FromUTF16LE((const unsigned short*)encoded.c_str(),
-                                    encoded.GetLength());
+  str = CFX_WideString::FromUTF16LE(
+      reinterpret_cast<const unsigned short*>(encoded.c_str()),
+      encoded.GetLength() / sizeof(unsigned short));
   return *this;
 }
 FX_BOOL CFX_ArchiveLoader::Read(void* pBuf, FX_DWORD dwSize) {
diff --git a/core/src/fxcrt/fx_basic_wstring.cpp b/core/src/fxcrt/fx_basic_wstring.cpp
index 220ffbd57d..7ea7e8e112 100644
--- a/core/src/fxcrt/fx_basic_wstring.cpp
+++ b/core/src/fxcrt/fx_basic_wstring.cpp
@@ -287,19 +287,17 @@ CFX_ByteString CFX_WideString::UTF8Encode() const {
   return FX_UTF8Encode(*this);
 }
 CFX_ByteString CFX_WideString::UTF16LE_Encode() const {
-  if (m_pData == NULL) {
-    return CFX_ByteString(FX_BSTRC("\0\0"));
+  CFX_ByteString result;
+  if (!m_pData) {
+    return result;
   }
   int len = m_pData->m_nDataLength;
-  CFX_ByteString result;
-  FX_CHAR* buffer = result.GetBuffer(len * 2 + 2);
-  for (int i = 0; i < len; i++) {
+  FX_CHAR* buffer = result.GetBuffer(len * 2);
+  for (int i = 0; i < len; ++i) {
     buffer[i * 2] = m_pData->m_String[i] & 0xff;
     buffer[i * 2 + 1] = m_pData->m_String[i] >> 8;
   }
-  buffer[len * 2] = 0;
-  buffer[len * 2 + 1] = 0;
-  result.ReleaseBuffer(len * 2 + 2);
+  result.ReleaseBuffer(len * 2);
   return result;
 }
 void CFX_WideString::ConvertFrom(const CFX_ByteString& str,
diff --git a/core/src/fxcrt/fx_basic_wstring_unittest.cpp b/core/src/fxcrt/fx_basic_wstring_unittest.cpp
index 74410ddda3..22f42d7985 100644
--- a/core/src/fxcrt/fx_basic_wstring_unittest.cpp
+++ b/core/src/fxcrt/fx_basic_wstring_unittest.cpp
@@ -283,12 +283,12 @@ TEST(fxcrt, WideStringUTF16LE_Encode) {
     CFX_WideString ws;
     CFX_ByteString bs;
   } utf16le_encode_cases[] = {
-      {L"", ByteStringLiteral("\0\0")},
-      {L"abc", ByteStringLiteral("a\0b\0c\0\0\0")},
-      {L"abcdef", ByteStringLiteral("a\0b\0c\0d\0e\0f\0\0\0")},
-      {L"abc\0def", ByteStringLiteral("a\0b\0c\0\0\0")},
-      {L"\xaabb\xccdd", ByteStringLiteral("\xbb\xaa\xdd\xcc\0\0")},
-      {L"\x3132\x6162", ByteStringLiteral("\x32\x31\x62\x61\0\0")},
+      {L"", ByteStringLiteral("")},
+      {L"abc", ByteStringLiteral("a\0b\0c\0")},
+      {L"abcdef", ByteStringLiteral("a\0b\0c\0d\0e\0f\0")},
+      {L"abc\0def", ByteStringLiteral("a\0b\0c\0")},
+      {L"\xaabb\xccdd", ByteStringLiteral("\xbb\xaa\xdd\xcc")},
+      {L"\x3132\x6162", ByteStringLiteral("\x32\x31\x62\x61")},
   };
 
   for (size_t i = 0; i < FX_ArraySize(utf16le_encode_cases); ++i) {
-- 
cgit v1.2.3