From 704a617ec011cda5c821d210c83f311f0ba5b15c Mon Sep 17 00:00:00 2001
From: Lei Zhang <thestig@chromium.org>
Date: Mon, 19 Mar 2018 18:00:55 +0000
Subject: Avoid crashing in FPDFText_CountRects() for invalid start values.

BUG=chromium:821305

Change-Id: I371572f60ea3984ce044e25125d882b3c2d03115
Reviewed-on: https://pdfium-review.googlesource.com/28733
Commit-Queue: Lei Zhang <thestig@chromium.org>
Reviewed-by: Henrique Nakashima <hnakashima@chromium.org>
---
 core/fpdftext/cpdf_textpage.cpp | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'core')

diff --git a/core/fpdftext/cpdf_textpage.cpp b/core/fpdftext/cpdf_textpage.cpp
index 7315754919..91cfe8c6c9 100644
--- a/core/fpdftext/cpdf_textpage.cpp
+++ b/core/fpdftext/cpdf_textpage.cpp
@@ -242,8 +242,12 @@ std::vector<CFX_FloatRect> CPDF_TextPage::GetRectArray(int start,
     return rects;
 
   const int nCharListSize = CountChars();
+  if (start >= nCharListSize)
+    return rects;
+
   if (nCount < 0 || start + nCount > nCharListSize)
     nCount = nCharListSize - start;
+  ASSERT(nCount > 0);
 
   CPDF_TextObject* pCurObj = nullptr;
   CFX_FloatRect rect;
-- 
cgit v1.2.3