From 41c23536d10b04f56d0c4dfd1c36ee4664d9b7f9 Mon Sep 17 00:00:00 2001
From: tsepez <tsepez@chromium.org>
Date: Tue, 24 Jan 2017 09:31:33 -0800
Subject: Undefined shift in CPDF_PSEngine::DoOperator

Also fix an unsafe negation in same block.

BUG=641551
BUG=681091

Review-Url: https://codereview.chromium.org/2649283002
---
 core/fpdfapi/page/fpdf_page_func.cpp | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

(limited to 'core')

diff --git a/core/fpdfapi/page/fpdf_page_func.cpp b/core/fpdfapi/page/fpdf_page_func.cpp
index 9949e052c9..916641f05d 100644
--- a/core/fpdfapi/page/fpdf_page_func.cpp
+++ b/core/fpdfapi/page/fpdf_page_func.cpp
@@ -410,12 +410,15 @@ bool CPDF_PSEngine::DoOperator(PDF_PSOP op) {
       break;
     case PSOP_BITSHIFT: {
       int shift = (int)Pop();
-      int i = (int)Pop();
+      result = (int)Pop();
       if (shift > 0) {
-        Push(i << shift);
+        result <<= shift;
       } else {
-        Push(i >> -shift);
+        // Avoids unsafe negation of INT_MIN.
+        FX_SAFE_INT32 safe_shift = shift;
+        result >>= (-safe_shift).ValueOrDefault(0);
       }
+      Push(result.ValueOrDefault(0));
       break;
     }
     case PSOP_TRUE:
-- 
cgit v1.2.3