From 8daab317ff959905e926b861a7d2aa876fd10429 Mon Sep 17 00:00:00 2001
From: Bo Xu <bo_xu@foxitsoftware.com>
Date: Mon, 14 Jul 2014 12:13:53 -0700
Subject: Fix an out-of-boundary issue for wide string

BUG=381521
R=palmer@chromium.org

Review URL: https://codereview.chromium.org/383563002
---
 core/include/fxcrt/fx_string.h          |  6 ++++--
 core/src/fxcrt/fx_basic_util.cpp        |  2 +-
 core/src/fxcrt/fx_basic_wstring.cpp     | 28 ++++++++++++++--------------
 core/src/fxge/win32/fx_win32_device.cpp |  4 +++-
 4 files changed, 22 insertions(+), 18 deletions(-)

(limited to 'core')

diff --git a/core/include/fxcrt/fx_string.h b/core/include/fxcrt/fx_string.h
index fe56e1867e..26b04b70fa 100644
--- a/core/include/fxcrt/fx_string.h
+++ b/core/include/fxcrt/fx_string.h
@@ -634,9 +634,11 @@ public:
 
     static CFX_WideString	FromLocal(const char* str, FX_STRSIZE len = -1);
 
-    static CFX_WideString	FromUTF8(const char* str, FX_STRSIZE len = -1);
+    static CFX_WideString	FromUTF8(const char* str, FX_STRSIZE len);
 
-    static CFX_WideString	FromUTF16LE(const unsigned short* str, FX_STRSIZE len = -1);
+    static CFX_WideString	FromUTF16LE(const unsigned short* str, FX_STRSIZE len);
+
+    static FX_STRSIZE       WStringLength(const unsigned short* str);
 
     operator FX_LPCWSTR() const
     {
diff --git a/core/src/fxcrt/fx_basic_util.cpp b/core/src/fxcrt/fx_basic_util.cpp
index 1d947d3fed..dc5eea7821 100644
--- a/core/src/fxcrt/fx_basic_util.cpp
+++ b/core/src/fxcrt/fx_basic_util.cpp
@@ -273,7 +273,7 @@ CFX_WideString FX_DecodeURI(const CFX_ByteString& bsURI)
             rURI += bsURI[i];
         }
     }
-    return CFX_WideString::FromUTF8(rURI);
+    return CFX_WideString::FromUTF8(rURI, rURI.GetLength());
 }
 #if _FXM_PLATFORM_ == _FXM_PLATFORM_WINDOWS_
 class CFindFileData : public CFX_Object
diff --git a/core/src/fxcrt/fx_basic_wstring.cpp b/core/src/fxcrt/fx_basic_wstring.cpp
index 192579fe54..794630b9e5 100644
--- a/core/src/fxcrt/fx_basic_wstring.cpp
+++ b/core/src/fxcrt/fx_basic_wstring.cpp
@@ -398,15 +398,10 @@ CFX_WideString CFX_WideString::FromLocal(const char* str, FX_STRSIZE len)
 }
 CFX_WideString CFX_WideString::FromUTF8(const char* str, FX_STRSIZE len)
 {
-    if (!str) {
+    if (!str || 0 == len) {
         return CFX_WideString();
     }
-    if (len < 0) {
-        len = 0;
-        while (str[len]) {
-            len ++;
-        }
-    }
+
     CFX_UTF8Decoder decoder;
     for (FX_STRSIZE i = 0; i < len; i ++) {
         decoder.Input(str[i]);
@@ -415,15 +410,10 @@ CFX_WideString CFX_WideString::FromUTF8(const char* str, FX_STRSIZE len)
 }
 CFX_WideString CFX_WideString::FromUTF16LE(const unsigned short* wstr, FX_STRSIZE wlen)
 {
-    if (!wstr || !wlen) {
+    if (!wstr || 0 == wlen) {
         return CFX_WideString();
     }
-    if (wlen < 0) {
-        wlen = 0;
-        while (wstr[wlen]) {
-            wlen ++;
-        }
-    }
+
     CFX_WideString result;
     FX_WCHAR* buf = result.GetBuffer(wlen);
     for (int i = 0; i < wlen; i ++) {
@@ -432,6 +422,16 @@ CFX_WideString CFX_WideString::FromUTF16LE(const unsigned short* wstr, FX_STRSIZ
     result.ReleaseBuffer(wlen);
     return result;
 }
+FX_STRSIZE CFX_WideString::WStringLength(const unsigned short* str)
+{
+    FX_STRSIZE len = 0;
+    if (str)
+        while (str[len]) len++;
+    return len;
+}
+
+
+
 void CFX_WideString::AllocCopy(CFX_WideString& dest, FX_STRSIZE nCopyLen, FX_STRSIZE nCopyIndex) const
 {
     // |FX_STRSIZE| is currently typedef'd as in |int|. TODO(palmer): It
diff --git a/core/src/fxge/win32/fx_win32_device.cpp b/core/src/fxge/win32/fx_win32_device.cpp
index 2e2ea9a92b..9c03a30837 100644
--- a/core/src/fxge/win32/fx_win32_device.cpp
+++ b/core/src/fxge/win32/fx_win32_device.cpp
@@ -328,7 +328,9 @@ void* CWin32FontInfo::MapFont(int weight, FX_BOOL bItalic, int charset, int pitc
     for (int i = 0; i < iCount; ++i) {
         if (face == VariantNames[i].m_pFaceName) {
             CFX_WideString wsFace = CFX_WideString::FromLocal(facebuf);
-            CFX_WideString wsName = CFX_WideString::FromUTF16LE((const unsigned short*)VariantNames[i].m_pVariantName);
+            const unsigned short* pName = (const unsigned short*)VariantNames[i].m_pVariantName;
+            FX_STRSIZE len = CFX_WideString::WStringLength(pName);
+            CFX_WideString wsName = CFX_WideString::FromUTF16LE(pName, len);
             if (wsFace == wsName) {
                 return hFont;
             }
-- 
cgit v1.2.3